CVE-2026-71556 in go-git
Summary
by MITRE • 08/07/2026
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in go-git represents a critical path traversal issue that stems from improper handling of symbolic links during worktree operations. This flaw affects versions prior to 5.19.2 and 6.0.0-alpha.5, where the library fails to contain symbolic link resolution within the intended working directory boundaries. The technical implementation allows attackers to craft malicious repositories containing carefully constructed symbolic links that can bypass normal file system access controls when standard git operations such as checkout, status, and add are performed against these repositories.
This vulnerability operates at the intersection of file system security and software library design, specifically manifesting as a weakness in path resolution logic. The flaw enables an attacker to create repository structures where symbolic links point outside the legitimate working directory, effectively allowing arbitrary file system access. When go-git processes these malicious repositories, it follows symbolic links without proper boundary enforcement, creating opportunities for both information disclosure and potential modification of files outside the intended worktree scope. This behavior directly violates fundamental security principles of containment and privilege separation that should be maintained during routine file operations.
The operational impact of this vulnerability extends beyond simple path traversal, as it can enable attackers to access sensitive files, modify system resources, or even execute malicious code through carefully crafted repository structures. The implications are particularly severe in environments where go-git is used for automated repository handling, continuous integration systems, or any scenario involving untrusted repository content. Attackers could leverage this vulnerability to read configuration files, credentials, or other sensitive data stored outside the repository's intended scope, while also potentially writing malicious content to system locations accessible through symbolic link traversal.
From a cybersecurity perspective, this vulnerability aligns with CWE-22 (Improper Limiting of a Pathname to a Restricted Directory) and represents a classic case of insufficient input validation in file system operations. The ATT&CK framework categorizes this as a technique involving privilege escalation and information gathering through path manipulation. Organizations utilizing go-git libraries should prioritize immediate patching to versions 5.19.2 or 6.0.0-alpha.5, while implementing additional safeguards such as repository sanitization procedures for untrusted content. The fix implemented in these patched versions ensures that symbolic link resolution is properly confined to the worktree boundaries, preventing unauthorized access to files outside the intended directory structure. Security teams should also consider monitoring for potential exploitation attempts and implement network-based controls to prevent unauthorized repository cloning from suspicious sources.