{"uuid": "67679080-80cf-4ad8-97ab-22e8a2ba88f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hc8v-wwc9-vgxm", "type": "seen", "source": "https://gist.github.com/alon710/96191d79926d3727c699122d4f73553a", "content": "# CVE-2026-71556: CVE-2026-71556: Symbolic Link Directory Traversal in go-git\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71556\n\n## Summary\nA symbolic link directory traversal vulnerability was identified in go-git, a pure Go implementation of the Git specification. This vulnerability allows an attacker to construct a repository that, when checked out or processed, bypasses directory boundaries to write or overwrite arbitrary files on the host filesystem.\n\n## TL;DR\nA path traversal vulnerability in go-git allows malicious repositories to overwrite files outside the worktree via crafted symbolic links, potentially leading to remote code execution.\n\n## Technical Details\n\n- **CWE ID**: CWE-59\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1 (High)\n- **Exploit Status**: None / Poc Conceptual\n- **CISA KEV Status**: Not Listed\n- **Primary Weakness**: Improper Link Resolution Before File Access\n\n## Affected Systems\n\n- Applications using go-git\n- CI/CD pipelines relying on programmatic git cloning\n- Developer tools using go-git integrations\n- **go-git**: < 5.19.2 (Fixed in: `5.19.2`)\n- **go-git**: >= 6.0.0-alpha.1, < 6.0.0-alpha.5 (Fixed in: `6.0.0-alpha.5`)\n\n## Mitigation\n\n- Upgrade the go-git library dependency to patched versions.\n- Deploy applications in isolated containers or ephemeral sandboxes.\n- Perform static analysis validation on go modules in continuous integration pipelines.\n\n**Remediation Steps:**\n1. Analyze current project dependencies using `govulncheck` or similar static scanners.\n2. Update dependency file (go.mod) to require `github.com/go-git/go-git/v5` version 5.19.2 or higher.\n3. Recompile and deploy downstream binaries containing the updated library.\n4. Sanitize or restrict the input sources of remote repository clones if they cannot be fully trusted.\n\n## References\n\n- [GitHub Security Advisory GHSA-hc8v-wwc9-vgxm](https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm)\n- [NVD - CVE-2026-71556](https://nvd.nist.gov/vuln/detail/CVE-2026-71556)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71556) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T11:33:31.460311Z"}