Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M
CVE-2026-71557go-git: Malicious reference names may modify files outside the reference storage
Medium 6.3
In plain English
A medium-severity path traversal in go-git from go-git. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-go-git-go-git | no fix listed | DEBIAN-CVE-2026-71557 |
| Debian:13 | golang-github-go-git-go-git | no fix listed | DEBIAN-CVE-2026-71557 |
| Debian:14 | golang-github-go-git-go-git | 5.19.2-1 | DEBIAN-CVE-2026-71557 |
| Debian:14 | golang-github-go-git-go-git-v6 | 6.0.0~alpha.5-1 | DEBIAN-CVE-2026-71557 |
| Go | github.com/go-git/go-git/v5 | 5.19.2 | GHSA-qgq7-7hm3-q39j |
| Go | github.com/go-git/go-git/v5 | 5.19.2 | GO-2026-6214 |
| Go | github.com/go-git/go-git/v6 | 6.0.0-alpha.5 | GO-2026-6214 |
| Go | github.com/go-git/go-git/v6 | 6.0.0-alpha.5 | GHSA-qgq7-7hm3-q39j |
| Ubuntu:26.10 | golang-github-go-git-go-git | no fix listed | UBUNTU-CVE-2026-71557 |
| Ubuntu:26.10 | golang-github-go-git-go-git-v6 | no fix listed | UBUNTU-CVE-2026-71557 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
References
- https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j x_refsource_CONFIRM
- https://github.com/go-git/go-git/pull/2247 x_refsource_MISC
- https://github.com/go-git/go-git/pull/2254 x_refsource_MISC
- https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7 x_refsource_MISC
- https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36 x_refsource_MISC
- https://github.com/go-git/go-git/releases/tag/v5.19.2 x_refsource_MISC
- https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5 x_refsource_MISC