Path traversal in go-git - CVE-2026-71557

Vulnerability details

The vulnerability allows a remote user to modify files outside the intended reference storage.

The vulnerability exists due to path traversal in the `storage/filesystem` package `dotgit` reference storage when processing attacker-controlled reference names during clone or fetch operations. A remote user can advertise a specially crafted reference name to modify files outside the intended reference storage.

This affects filesystem-backed repositories, while instances using only the in-memory `storage/memory` implementation are not affected. User interaction is required for an application using filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.

Affected software

How to mitigate CVE-2026-71557

External References

• https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j
• https://github.com/go-git/go-git/pull/2247

Related Security Bulletins

• Multiple vulnerabilities in go-git
• SUSE update for amazon-ssm-agent