CVE-2026-71556: Symbolic Link Directory Traversal in go-git
Vulnerability ID: CVE-2026-71556
CVSS Score: 7.1
Published: 2026-08-07
A symbolic link directory traversal vulnerability was identified in go-git, a pure Go implementation of the Git specification. This vulnerability allows an attacker to construct a repository that, when checked out or processed, bypasses directory boundaries to write or overwrite arbitrary files on the host filesystem.
TL;DR
A path traversal vulnerability in go-git allows malicious repositories to overwrite files outside the worktree via crafted symbolic links, potentially leading to remote code execution.
Technical Details
- CWE ID: CWE-59
- Attack Vector: Network
- CVSS Score: 7.1 (High)
- Exploit Status: None / Poc Conceptual
- CISA KEV Status: Not Listed
- Primary Weakness: Improper Link Resolution Before File Access
Affected Systems
- Applications using go-git
- CI/CD pipelines relying on programmatic git cloning
- Developer tools using go-git integrations
-
go-git: < 5.19.2 (Fixed in:
5.19.2) -
go-git: >= 6.0.0-alpha.1, < 6.0.0-alpha.5 (Fixed in:
6.0.0-alpha.5)
Code Analysis
Commit: 008a78f
worktree: clear blocking symlinks on checkout
Commit: 661d1c7
worktree: validate paths in worktree filesystem wrapper
Mitigation Strategies
- Upgrade the go-git library dependency to patched versions.
- Deploy applications in isolated containers or ephemeral sandboxes.
- Perform static analysis validation on go modules in continuous integration pipelines.
Remediation Steps:
- Analyze current project dependencies using
govulncheckor similar static scanners. - Update dependency file (go.mod) to require
github.com/go-git/go-git/v5version 5.19.2 or higher. - Recompile and deploy downstream binaries containing the updated library.
- Sanitize or restrict the input sources of remote repository clones if they cannot be fully trusted.
References
Read the full report for CVE-2026-71556 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)