CVE-2026-128034
MEDIUM
NVD
CVSS Score
5.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.