Symlink Traversal Vulnerability in go-git

The go-git library is susceptible to a symlink traversal vulnerability (CVE-2026-71556) affecting versions v5.19.1 and earlier, as well as v6.0.0-alpha.4 and earlier. The vulnerability exists within the worktree filesystem wrapper, which failed to correctly sanitize symbolic links during file operations. While the library previously implemented checks against path strings containing parent-directory components or control characters, it did not account for symbolic links already present in the worktree. An attacker who can influence the content of a Git repository or directory being processed can introduce a symbolic link that points to sensitive locations, such as the .git metadata directory. When the library performs file operations through this path, it follows the symlink, resulting in an escape from the intended directory. This could lead to the modification or truncation of sensitive repository configuration files. Applications that rely on memory-based storage or go-billy/memfs are not affected.

Impact

Successful exploitation allows for out-of-bounds file writes, potentially enabling an attacker to corrupt repository metadata, modify git configurations, or cause denial-of-service by overwriting essential files. This issue poses a significant risk to CI/CD pipelines, build systems, and development environments that process untrusted repositories using vulnerable versions of go-git.

Recommendation

• Upgrade go-git to a patched version that implements a symlink-safe boundary for filesystem operations.
• Review applications currently utilizing filesystem-backed worktrees for processing untrusted git repositories.
• Prioritize migration to memory-based storage for sensitive operations where the performance or persistence requirements permit.