CVE-2026-71557— go-git: Malicious reference names may modify files outside the reference storage
Possible ATT&CK Techniques 1AI
T1564.004 · NTFS File AttributesGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-71557
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
go-git: Malicious reference names may modify files outside the reference storage
Source: CVE Program / CVE List V5
Vulnerability Description
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-71557
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-71557
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-71557 (5)
- 🔗 Release v5.19.2 · go-git/go-git · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-71557 (1)
Vendor Pages for CVE-2026-71557 (1)
- 🔗 Release v6.0.0-alpha.5 · go-git/go-git · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: go-git
- CVE-2026-71556
go-git: Worktree operations may follow symlinks - CVE-2026-45570
go-git: Improper single-quote escaping in go-git SSH transpo - CVE-2026-45571
go-git: Crafted repositories may modify main and submodule . - CVE-2026-45022
go-git: Improper parsing of specially crafted objects may le - CVE-2026-41506
go-git Credential leak via cross-host redirect in smart HTTP
Same vendor: go-git
- CVE-2026-71556
go-git: Worktree operations may follow symlinks - CVE-2026-44740
go-billy: Lack of depth and cycle detection in symlink resol - CVE-2026-44973
Billy: Path traversal vulnerabilities - CVE-2026-45570
go-git: Improper single-quote escaping in go-git SSH transpo - CVE-2026-45571
go-git: Crafted repositories may modify main and submodule .
Same weakness: CWE-22
- CVE-2026-12339
Authenticated Arbitrary File Write Vulnerability in multiple - CVE-2026-47754
unauthenticated path traversal in Metacat 2.x - CVE-2026-15059
systemd-oomd: unprivileged users can terminate arbitrary pro - CVE-2026-72572
o1lab xmysql - Unauthenticated Path Traversal via name Query - CVE-2026-72571
mustafaakin cast-localvideo - Unauthenticated Path Traversal
V. Comments for CVE-2026-71557
No comments yet