Link following in go-git - #VU140594
Published: July 31, 2026
Vulnerability identifier: #VU140594
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
go-git
go-git
Detailed vulnerability description
The vulnerability allows a remote attacker to modify files outside the intended worktree path.
The vulnerability exists due to improper link resolution before file access in the worktree filesystem wrapper when performing worktree file operations on attacker-controlled symbolic link paths. A remote attacker can introduce a symbolic link in the worktree and cause the application to perform a write through that path to modify files outside the intended worktree path.
User interaction is required, and exploitation requires the attacker to be able to introduce or control a symbolic link in the worktree.
Remediation
Install security update from vendor's website.