CVE-2026-71556: Symbolic Link Directory Traversal in go-git

Vulnerability ID: CVE-2026-71556
CVSS Score: 7.1
Published: 2026-08-07

A symbolic link directory traversal vulnerability was identified in go-git, a pure Go implementation of the Git specification. This vulnerability allows an attacker to construct a repository that, when checked out or processed, bypasses directory boundaries to write or overwrite arbitrary files on the host filesystem.

TL;DR

A path traversal vulnerability in go-git allows malicious repositories to overwrite files outside the worktree via crafted symbolic links, potentially leading to remote code execution.

Technical Details

• CWE ID: CWE-59
• Attack Vector: Network
• CVSS Score: 7.1 (High)
• Exploit Status: None / Poc Conceptual
• CISA KEV Status: Not Listed
• Primary Weakness: Improper Link Resolution Before File Access

Affected Systems

• Applications using go-git
• CI/CD pipelines relying on programmatic git cloning
• Developer tools using go-git integrations
• go-git: < 5.19.2 (Fixed in: 5.19.2)
• go-git: >= 6.0.0-alpha.1, < 6.0.0-alpha.5 (Fixed in: 6.0.0-alpha.5)

Code Analysis

Commit: 008a78f

worktree: clear blocking symlinks on checkout

Commit: 661d1c7

worktree: validate paths in worktree filesystem wrapper

Mitigation Strategies

• Upgrade the go-git library dependency to patched versions.
• Deploy applications in isolated containers or ephemeral sandboxes.
• Perform static analysis validation on go modules in continuous integration pipelines.

Remediation Steps:

1. Analyze current project dependencies using govulncheck or similar static scanners.
2. Update dependency file (go.mod) to require github.com/go-git/go-git/v5 version 5.19.2 or higher.
3. Recompile and deploy downstream binaries containing the updated library.
4. Sanitize or restrict the input sources of remote repository clones if they cannot be fully trusted.

References

• GitHub Security Advisory GHSA-hc8v-wwc9-vgxm
• NVD - CVE-2026-71556

Read the full report for CVE-2026-71556 on our website for more details including interactive diagrams and full exploit analysis.