{"uuid": "20a17efb-d9da-4f45-84e9-a7c9d46ecc7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "seen", "source": "https://gist.github.com/alon710/71d0ff9c71dc1f5ee8e40bba3da46014", "content": "# CVE-2026-71557: CVE-2026-71557: Path Traversal and Configuration Overwrite in go-git Filesystem Storage Engine\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71557\n\n## Summary\nCVE-2026-71557 is a path traversal vulnerability in go-git, a pure-Go implementation of Git. In vulnerable versions, the filesystem-backed storage engine fails to validate reference names before mapping them to on-disk paths. An attacker hosting a malicious Git server can advertise references containing directory traversal sequences, such as 'refs/heads/../../config', to write or overwrite files outside the intended reference storage directory.\n\n## TL;DR\nA path traversal flaw in go-git's reference processing allows a malicious remote server to overwrite local repository configuration files (such as .git/config) during clone or fetch operations, potentially leading to arbitrary command execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.3 (Medium)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **Impact**: High Integrity (I:H), Low Availability (A:L), Remote Code Execution (RCE)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing github.com/go-git/go-git/v5 prior to v5.19.2 with filesystem-backed storage engines\n- Applications utilizing github.com/go-git/go-git/v6 from v6.0.0-alpha.1 to v6.0.0-alpha.4 with filesystem-backed storage engines\n\n## Mitigation\n\n- Upgrade the go-git library to the latest safe release branch.\n- Migrate the repository storage implementation from filesystem-backed storage to in-memory storage.\n- Enforce network perimeter access controls to prevent interactions with untrusted or public third-party Git hosting platforms.\n\n**Remediation Steps:**\n1. Update your Go project dependencies to pull go-git v5.19.2 or v6.0.0-alpha.5.\n2. Verify the dependency resolution change in the go.mod and go.sum files.\n3. Audit internal tools that perform clone or fetch operations, modifying the configuration to leverage storage/memory where appropriate.\n\n## References\n\n- [GitHub Security Advisory GHSA-qgq7-7hm3-q39j](https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j)\n- [Public Proof of Concept Repository](https://github.com/Saku0512/CVE-2026-71557-poc)\n- [go-git Pull Request #2247](https://github.com/go-git/go-git/pull/2247)\n- [go-git Pull Request #2254](https://github.com/go-git/go-git/pull/2254)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71557) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T10:39:06.928392Z"}