GPL-based Git Implementation Affected by Directory Traversal Vulnerability
CVE-2026-71557
6.3MEDIUM
What is CVE-2026-71557?
The go-git library, a pure Go implementation of Git, has a vulnerability related to improper sanitization of reference names before they are used to construct on-disk paths. As a result, an attacker could craft a malicious reference name containing directory-traversal sequences, allowing files to be written outside the designated reference storage directory. This vulnerability could jeopardize the security of the file system. Versions 5.19.2 and 6.0.0-alpha.5 have addressed this critical issue.
Affected Version(s)
go-git < 5.19.2 < 5.19.2
go-git >= 6.0.0-alpha.1, < 6.0.0-alpha.5 < 6.0.0-alpha.1, 6.0.0-alpha.5