CVE-2026-71556: go-git Path Traversal Vulnerability

CVE-2026-71556 Overview

CVE-2026-71556 is a symlink-based path traversal vulnerability in go-git, an extensible Git implementation library written in pure Go. Worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary. A maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory. Exploitation requires a victim to clone the malicious repository and invoke worktree operations. The issue is fixed in versions 5.19.2 and 6.0.0-alpha.5.

Critical Impact

Attackers can write arbitrary files outside the worktree by publishing a repository containing crafted symlinks, enabling code execution when overwriting shell profiles, SSH configs, or CI scripts.

Affected Products

• go-git versions prior to 5.19.2
• go-git6.0.0-alpha releases prior to 6.0.0-alpha.5
• Downstream tools and applications that embed go-git for repository cloning or worktree management

Discovery Timeline

• 2026-08-07 - CVE-2026-71556 published to NVD
• 2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-71556

Vulnerability Analysis

The vulnerability [CWE-59: Improper Link Resolution Before File Access] resides in go-git's worktree handling code. When materializing repository contents onto disk, the library invokes filesystem operations that traverse symbolic links without validating that the resolved target remains within the worktree root. A repository can be crafted so that a tracked path first creates a symlink pointing to an attacker-chosen location, then subsequent entries write through that symlink. Because worktree operations run with the privileges of the calling process, resulting writes can land in ~/.ssh/authorized_keys, ~/.bashrc, CI configuration directories, or any other location writable by the user. User interaction is required: the victim must clone or update from the malicious repository.

Root Cause

The underlying billy.Filesystem wrapper used by go-git did not enforce a symlink-safe boundary. Directory creation calls such as Filesystem.MkdirAll and file writes followed existing symlinks on the host filesystem rather than treating a symlinked path segment as a boundary violation. No pre-write check existed to clear or reject blocking symlinks along the target path.

Attack Vector

An attacker publishes a Git repository whose tree contains a symlink entry (for example, link -> /home/victim/.ssh) followed by a regular file entry at link/authorized_keys. When a victim application built on go-git clones and checks out this repository, go-git creates the symlink first, then writes the second entry through it, placing attacker-controlled content outside the worktree.

// Patch from commit 008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab
// Adds a symlink-safe boundary check before directory creation
			return err
		}

+		if err := w.clearBlockingSymlinks(name); err != nil {
+			return err
+		}
+
		if err := w.Filesystem.MkdirAll(name, mode); err != nil {
			return err
		}

Source: go-git commit 008a78f

The fix introduces clearBlockingSymlinks, which removes or rejects symlink components along the target path before any MkdirAll or write occurs. A parallel change in worktree_commit.go routes cherry-pick materialization through the same validating filesystem so that all write paths share the boundary enforcement.

// Patch from commit 661d1c7f101d34e002a3cfcf8dbea5b7421d07ac
// Routes cherry-pick through the validating filesystem wrapper
+	cfg, err := w.r.Config()
+	if err != nil {
+		return err
+	}
+
+	// Materialise changes through the same validating filesystem and
+	// checkout path as reset/checkout, so cherry-pick shares their
+	// leading-symlink handling, mode awareness (symlinks, exec bits,
+	// CRLF) and root reuse instead of writing raw bytes via Create.
+	fs, closeFS := w.reusableRootFS()
+	defer closeFS()

Source: go-git commit 661d1c7

Detection Methods for CVE-2026-71556

Indicators of Compromise

• Presence of unexpected symlink entries in cloned repositories that point outside the worktree, for example targets containing ../ sequences or absolute paths such as /etc, /home/<user>/.ssh, or /root.
• File writes to sensitive locations (~/.ssh/authorized_keys, ~/.bashrc, ~/.profile, CI runner directories) with timestamps aligned to a git clone or go-git worktree operation.
• Process telemetry showing a Go application performing filesystem writes outside its declared workspace directory during clone or checkout.

Detection Strategies

• Inspect Go application dependency manifests (go.mod, go.sum) for github.com/go-git/go-git versions below 5.19.2 or pre-release 6.0.0-alpha builds earlier than alpha.5.
• Add static analysis rules to CI pipelines that fail builds when vulnerable go-git versions are detected.
• Audit repository ingestion services for anomalous symlink entries prior to executing worktree operations.

Monitoring Recommendations

• Monitor file integrity for user home directory dotfiles and SSH configuration paths on hosts that clone untrusted repositories.
• Log and alert on worktree operations that resolve to paths outside the configured clone root.
• Track outbound writes from CI/CD workers and Git-consuming microservices, correlating them with repository URLs handled during the same session.

How to Mitigate CVE-2026-71556

Immediate Actions Required

• Upgrade all applications and services that embed go-git to version 5.19.2 or 6.0.0-alpha.5 and rebuild affected binaries.
• Inventory Go binaries in production and CI environments to confirm no vulnerable go-git versions remain in use.
• Restrict cloning of untrusted repositories from services that have not yet been patched.

Patch Information

Fixed versions are available at go-git v5.19.2 and go-git v6.0.0-alpha.5. Full remediation details are documented in GitHub Security Advisory GHSA-hc8v-wwc9-vgxm. Update the dependency with go get github.com/go-git/go-git/v5@v5.19.2 and run go mod tidy to lock the fixed version.

Workarounds

• Run applications that use go-git inside an unprivileged container or sandbox with a read-only host filesystem, limiting the blast radius of out-of-tree writes.
• Reject or sanitize repositories containing symlinks before invoking go-git worktree operations, or use a Git implementation that enforces worktree boundary checks.
• Execute clone and checkout under a dedicated low-privilege user account whose home directory contains no sensitive dotfiles or credentials.

# Update go-git to a patched version in a Go project
go get github.com/go-git/go-git/v5@v5.19.2
go mod tidy
go build ./...

# Verify the resolved version
go list -m github.com/go-git/go-git/v5