CVE-2026-71557: go-git Path Traversal Vulnerability

CVE-2026-71557 Overview

CVE-2026-71557 is a path traversal vulnerability [CWE-22] in go-git, an extensible Git implementation library written in pure Go. The library fails to sanitize reference names before using them to construct on-disk paths under the reference storage directory. A maliciously crafted reference name containing directory-traversal sequences can cause go-git to write files outside the intended reference storage directory. The issue affects versions prior to 5.19.2 and 6.0.0-alpha.5. Both releases contain the fix.

Critical Impact
Attackers who supply crafted Git reference names to applications using vulnerable go-git versions can write arbitrary files outside the reference storage directory, potentially overwriting repository metadata or unrelated files on disk.

Affected Products

go-git versions prior to 5.19.2
go-git versions prior to 6.0.0-alpha.5
Go applications and services embedding vulnerable go-git releases

Discovery Timeline

2026-08-07 - CVE-2026-71557 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-71557

Vulnerability Analysis

The flaw resides in how go-git translates Git reference names into filesystem paths under the .git/refs/ directory. Git reference names such as refs/heads/main map directly to files on disk. The library concatenated attacker-controlled reference names onto the reference storage directory without validating that the resulting path stayed within that directory.

A reference name containing .. components, backslashes on Windows, or absolute path prefixes escapes the intended sub-tree. The write operation then lands on unrelated repository metadata or arbitrary filesystem locations reachable by the process. Exploitation requires the victim application to accept a reference name from an untrusted source, for example, from a remote peer during fetch operations or from user-supplied Git operations.

The patch introduces a new IsSafe() method on the ReferenceName type. This mirrors Git's native refname_is_safe logic from refs.c. Names must either live under refs/ with no empty, ., .., or backslash-containing components, or be a one-level pseudo-reference matching [A-Z_]+ such as HEAD or FETCH_HEAD.

Root Cause

The root cause is missing input validation on ReferenceName values before they are joined with the reference storage directory path. The storage/filesystem/dotgit package used raw reference strings as path segments, violating containment guarantees that Git itself enforces at the C implementation level.

Attack Vector

The attack vector is network-accessible. An attacker with low privileges triggers the flaw by delivering a crafted reference name through Git protocol operations. User interaction is required, such as a developer running a fetch against a malicious remote.

// Security patch in plumbing/reference.go
// Source: https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7

// IsSafe reports whether the reference name can be safely turned into a path
// under the .git directory, mirroring Git's refname_is_safe (refs.c). A name
// is safe when it is either:
//
//   - under "refs/", non-empty after the prefix, containing no backslash and
//     no empty, "." or ".." path component (so it cannot escape the refs/
//     sub-tree, or alias another name, once turned into a path); or
//   - a one-level pseudo-ref whose spelling is restricted to [A-Z_]
//     (e.g. HEAD, ORIG_HEAD, FETCH_HEAD).
func (r ReferenceName) IsSafe() bool {
	s := string(r)
	if s == "" {
		return false
	}

	if rest, ok := strings.CutPrefix(s, refPrefix); ok {
		// '\' is a path separator on Windows, so a refs/ name containing one
		// could escape the sub-tree or alias another name once turned into a
		// path; reject it outright (check_refname_format forbids '\' too).
		if rest == "" || strings.Contains(rest, "\\") {
			return false
		}
		for part := range strings.SplitSeq(rest, "/") {
			// reject empty, ".", and ".." components
		}
	}
}

Detection Methods for CVE-2026-71557

Indicators of Compromise

Unexpected files appearing outside .git/refs/ inside repositories managed by Go applications using go-git.
Reference names in Git protocol traffic containing .., backslashes, or absolute path prefixes.
Modifications to files such as .git/config, .git/HEAD, or .git/hooks/* that were not initiated by legitimate Git operations.

Detection Strategies

Inventory Go binaries and container images for imports of github.com/go-git/go-git at versions below 5.19.2 or 6.0.0-alpha.5 using software composition analysis.
Instrument applications that call go-git fetch or clone routines to log all incoming reference names and flag names failing the new IsSafe() criteria.
Review file integrity monitoring alerts targeting Git repository directories for writes outside the expected refs/ sub-tree.

Monitoring Recommendations

Enable filesystem auditing on directories used as working trees or bare repositories for go-git-based services.
Correlate outbound fetch operations from CI/CD runners against a baseline of trusted remote URLs.
Monitor process activity for Git-related workloads writing to unexpected paths such as system directories or configuration files.

How to Mitigate CVE-2026-71557

Immediate Actions Required

Upgrade go-git to 5.19.2 or 6.0.0-alpha.5 and rebuild all dependent applications and container images.
Audit dependency manifests (go.mod, go.sum) across repositories and CI pipelines to confirm no transitive pin to a vulnerable version remains.
Restrict go-git-based services from interacting with untrusted remote Git repositories until patched.

Patch Information

The upstream fix is delivered in GitHub Release v5.19.2 and GitHub Release v6.0.0-alpha.5. Technical details appear in GitHub Security Advisory GHSA-qgq7-7hm3-q39j. The containment logic is introduced in Pull Request #2254 and Pull Request #2247.

Workarounds

Validate reference names at the application layer before passing them to go-git APIs, rejecting names containing .., backslashes, or leading /.
Run go-git-based services under a dedicated low-privilege account with write access limited to the intended repository directory only.
Where possible, operate on repositories in ephemeral sandboxes such as short-lived containers to contain the blast radius of a successful write.

bash

# Update go-git dependency to the patched release
go get github.com/go-git/go-git/v5@v5.19.2
go mod tidy

# Verify the resolved version
go list -m github.com/go-git/go-git/v5