CVE-2026-71557
go-git: Malicious reference names may modify files outside the reference storage
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
| CWE | CWE-22 |
| Vendor | go-git |
| Product | go-git |
| Published | Aug 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-git go-git
Be the first to know when new medium vulnerabilities affecting go-git go-git are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
go-git / go-git
< 5.19.2 >= 6.0.0-alpha.1, < 6.0.0-alpha.5
References
github.com: https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j github.com: https://github.com/go-git/go-git/pull/2247 github.com: https://github.com/go-git/go-git/pull/2254 github.com: https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7 github.com: https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36 github.com: https://github.com/go-git/go-git/releases/tag/v5.19.2 github.com: https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5