go-git Symlink Traversal Vulnerability Advisory (CVE-2026-71556)

Vulnerability Overview Vulnerability Name: Worktree operations may follow symlinks CVE ID: CVE-2026-71556 CVSS v3 Base Metrics: 7.1 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: High Availability: Low Affected Scope Affected Versions: - (<= 5.19.1) - (<= 6.0.0-alpha.4) Impact Description: - A symlink traversal issue in may allow worktree operations to modify files outside the worktree path. - The wrapper rejects dangerous path strings, such as those containing (parent directory components) or control characters. However, it does not prevent filesystem operations from following existing symlinks within the worktree. - For example, if is a symlink pointing to , writing to will modify . - If directly points to , opening for writing could overwrite the repository configuration. - Exploitation requires the attacker to be able to introduce or control symlinks within the worktree and induce the application to perform write operations through that path. - Applications using as their storage backend, or as their worktree implementation, are not affected by this vulnerability. Remediation Patch Versions: - (5.19.2) - (6.0.0-alpha.5) Patch Description: - The issue is resolved by making the worktree filesystem wrapper a safe boundary for symlinks. - Worktree operations now reject any path where an existing symlink is present at any path component, which could cause the operation to escape the intended worktree location, including symlinks at the final component. - Users of worktrees with filesystem backends should upgrade to the patched versions. Credits Reporter: @kodaree5 Independent Reporter: @HughLewin20 Additional Information Release Date: Last week GitHub Repository: go-git/go-git Security Quality Label: Security and quality --- Note: No specific POC (Proof of Concept) code or exploitation code is included in this advisory.

Goal Reached Thanks to every supporter — we hit 100%!

go-git Symlink Traversal Vulnerability Advisory (CVE-2026-71556)

More from this source