🛡️ CVE-2026-71556 — go-git

🟠 CVSS 8.0 — High ✅ No Known Exploit CWE-59 NVD
8.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

go-git: Worktree operations may follow symlinks

Impact

A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path.

The worktreeFilesystem wrapper rejected dangerous path strings, including paths containing .git, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.

As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if s is a symbolic link to .git, writing to s/config would modify .git/config.

A symbolic link at the final path component could also be followed. For example, if s points directly to .git/config, opening s for writing with truncation could overwrite the repository configuration.

Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.

Applications using storage/memory for their Storer, or go-billy/memfs for their Worktree, are not affected by this vulnerability.

Patches

The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.

Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.

Users of filesystem-backed worktrees should upgrade to a patched version.

Credits

Thanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. :1st_place_medal:

We would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity high, availability low.

Weakness class

CVE-2026-71556 is classified as CWE-59: Link Following. The software follows symbolic or hard links without verifying their target, so a planted link can redirect an operation to a sensitive file.

Affected software

CVE-2026-71556 is recorded against 3 packages.

  • github.com/go-git/go-git/v5
  • github.com/go-git/go-git/v6
  • unknown

Timeline and source

Published on 7 August 2026 and last revised on 8 August 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com (Web)
github.com (Web)
github.com (Web)
github.com (Package)
github.com (Web)
github.com (Web)

Details

Severity HIGH
CVSS Score 8.0
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
CWE CWE-59
Public Exploit ✅ No
Source NVD
Published 2026-08-07
Updated 2026-08-12
Modified 2026-08-08
Fix URL N/A

Affected Packages

Software From version Fixed in
github.com/go-git/go-git/v5 — —
github.com/go-git/go-git/v6 — —
unknown — —

Similar Threats

Site Security Check

Is go-git part of your stack?

CVE-2026-71556 is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.