Vulnerability-Lookup

CVE-2026-71556 (GCVE-0-2026-71556)

Vulnerability from cvelistv5 – Published: 2026-08-07 16:37 – Updated: 2026-08-07 16:58

Title

go-git: Worktree operations may follow symlinks

Summary

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/go-git/go-git/security/advisor…	x_refsource_CONFIRM
https://github.com/go-git/go-git/commit/008a78f2d…	x_refsource_MISC
https://github.com/go-git/go-git/commit/661d1c7f1…	x_refsource_MISC
https://github.com/go-git/go-git/releases/tag/v5.19.2	x_refsource_MISC
https://github.com/go-git/go-git/releases/tag/v6.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
go-git	go-git	Affected: < 5.19.2 Affected: >= 6.0.0-alpha.1, < 6.0.0-alpha.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71556",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T16:58:08.599214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T16:58:19.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-git",
          "vendor": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.19.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha.1, \u003c 6.0.0-alpha.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T16:37:40.058Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
        },
        {
          "name": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
        },
        {
          "name": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
        },
        {
          "name": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
        },
        {
          "name": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
        }
      ],
      "source": {
        "advisory": "GHSA-hc8v-wwc9-vgxm",
        "discovery": "UNKNOWN"
      },
      "title": "go-git: Worktree operations may follow symlinks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71556",
    "datePublished": "2026-08-07T16:37:40.058Z",
    "dateReserved": "2026-08-06T21:24:15.376Z",
    "dateUpdated": "2026-08-07T16:58:19.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71556",
      "date": "2026-08-08",
      "epss": "0.00292",
      "percentile": "0.21459"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"go-git: Worktree operations may follow symlinks\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-59\", \"lang\": \"en\", \"description\": \"CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"LOW\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm\"}, {\"name\": \"https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab\"}, {\"name\": \"https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac\"}, {\"name\": \"https://github.com/go-git/go-git/releases/tag/v5.19.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/go-git/go-git/releases/tag/v5.19.2\"}, {\"name\": \"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5\"}], \"affected\": [{\"vendor\": \"go-git\", \"product\": \"go-git\", \"versions\": [{\"version\": \"\u003c 5.19.2\", \"status\": \"affected\"}, {\"version\": \"\u003e= 6.0.0-alpha.1, \u003c 6.0.0-alpha.5\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-07T16:37:40.058Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.\"}], \"source\": {\"advisory\": \"GHSA-hc8v-wwc9-vgxm\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-71556\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-07T16:58:08.599214Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-07T16:58:13.955Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-71556\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-08-06T21:24:15.376Z\", \"datePublished\": \"2026-08-07T16:37:40.058Z\", \"dateUpdated\": \"2026-08-07T16:58:19.113Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-71556

Vulnerability from fkie_nvd - Published: 2026-08-07 17:17 - Updated: 2026-08-07 17:17

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab
	security-advisories@github.com	https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac
	security-advisories@github.com	https://github.com/go-git/go-git/releases/tag/v5.19.2
	security-advisories@github.com	https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5
	security-advisories@github.com	https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "go-git",
          "vendor": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.19.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha.1, \u003c 6.0.0-alpha.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5."
    }
  ],
  "id": "CVE-2026-71556",
  "lastModified": "2026-08-07T17:17:10.150",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71556",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T16:58:08.599214Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-07T17:17:10.150",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-HC8V-WWC9-VGXM

Vulnerability from github – Published: 2026-08-07 16:38 – Updated: 2026-08-07 16:38

Summary

go-git: Worktree operations may follow symlinks

Details

Impact

A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path.

The worktreeFilesystem wrapper rejected dangerous path strings, including paths containing .git, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.

As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if s is a symbolic link to .git, writing to s/config would modify .git/config.

A symbolic link at the final path component could also be followed. For example, if s points directly to .git/config, opening s for writing with truncation could overwrite the repository configuration.

Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.

Applications using storage/memory for their Storer, or go-billy/memfs for their Worktree, are not affected by this vulnerability.

Patches

The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.

Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.

Users of filesystem-backed worktrees should upgrade to a patched version.

Credits

Thanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. :1st_place_medal: We would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.19.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/go-git/go-git/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.19.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.0-alpha.4"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/go-git/go-git/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71556"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-07T16:38:15Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Impact\n\nA symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.\n\nThe `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.\n\nAs a result, a path that is safe when evaluated as a string could still resolve into the repository\u0027s Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`.\n\nA symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration.\n\nExploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.\n\nApplications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability.\n\n## Patches\n\nThe issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.\n\nWorktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.\n\nUsers of filesystem-backed worktrees should upgrade to a patched version.\n\n### Credits\n\nThanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. :1st_place_medal: \nWe would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.",
  "id": "GHSA-hc8v-wwc9-vgxm",
  "modified": "2026-08-07T16:38:15Z",
  "published": "2026-08-07T16:38:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-git/go-git"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "go-git: Worktree operations may follow symlinks"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-71556 (GCVE-0-2026-71556)

FKIE_CVE-2026-71556

GHSA-HC8V-WWC9-VGXM

Impact

Patches

Credits

Tags

Sightings

Nomenclature