Vulnerability Report

CVE-2026-71557

Title: Path Traversal

Path Traversal, Arbitrary File Write

Proof Of Concept

PoC Available for CVE-2026-71557

CWE Category CWE-22
Published Date Aug 07, 2026
Modified Date Aug 07, 2026
Exploit Status Available
Score 6.3 CVSS v3.1
Exploit Probability (EPSS)
0.35%

Vulnerability Summary

CVE-2026-71557: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7 https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36 https://github.com/go-git/go-git/pull/2247 https://github.com/go-git/go-git/pull/2254 https://github.com/go-git/go-git/releases/tag/v5.19.2 https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5 https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.3
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-71557 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Saku0512/CVE-2026-71557-poc
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction REQUIRED
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Affected Stack

No specific products linked.