CVE-2026-71557

Name of the Vulnerable Software and Affected Versions go-git versions prior to 5.19.2 go-git versions prior to 6.0.0-alpha.5

Description Reference names are not sanitized before being used to construct on-disk paths under the reference storage directory. A maliciously crafted reference name containing directory-traversal sequences can cause the library to write files outside the intended reference storage directory. This issue affects filesystem-backed repositories using the storage/filesystem package and its dotgit reference storage. A malicious Git server could advertise a reference name, such as refs/heads/../../config, which could resolve to unrelated repository metadata like .git/config or .git/HEAD. Exploitation occurs when an application using filesystem-backed storage interacts with a malicious Git server or processes attacker-controlled reference names.

Recommendations Update go-git to version 5.19.2 or later. Update go-git to version 6.0.0-alpha.5 or later. Avoid cloning from or fetching from untrusted Git servers. Validate reference names before passing them to filesystem-backed storage as a temporary mitigation.