CVE-2026-108599 Details

A vulnerability exists in Phi versions 0.1.1 through 0.28.4, where improper link resolution allows malicious repositories to exploit lexical-only path checks in the permission gate. This exploitation can bypass workspace-only write restrictions. Attackers can commit symlinks pointing outside the workspace, which are followed by the file write tool, enabling the injection of content into external files without proper approval. The issue arises because the permission gate authorizes paths based on their lexical representation, without resolving symlinks, creating a mismatch between authorization and actual file access.

The vulnerability can be addressed by updating to a version of Phi that has resolved this link resolution issue. Users should also review and adjust their permission policies to mitigate the risk of similar vulnerabilities.