Path traversal in go-git - #VU140595
Published: July 31, 2026
go-git
Detailed vulnerability description
The vulnerability allows a remote user to modify files outside the intended reference storage.
The vulnerability exists due to path traversal in the `storage/filesystem` package `dotgit` reference storage when processing attacker-controlled reference names during clone or fetch operations. A remote user can advertise a specially crafted reference name to modify files outside the intended reference storage.
This affects filesystem-backed repositories, while instances using only the in-memory `storage/memory` implementation are not affected. User interaction is required for an application using filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.