CVE-2026-45571
Path Traversal in go-git Library
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| go-git | go-git | to 6.0.0-alpha.4 (exc) |
| go-git | go-git | 5.19.1 |
| go-git | go-git | 6.0.0-alpha.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in go-git is due to a path validation issue that existed prior to versions 5.19.1 and 6.0.0-alpha.4. This flaw allows specially crafted repository data to affect files outside the intended checkout target directory, including the repository's .git directory. The problem arose because go-git did not maintain the same path validation checks that upstream Git had implemented years ago.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to manipulate files outside the intended checkout directory when using go-git. This could lead to unauthorized modification of files, including those in the .git directory, potentially compromising the integrity of the repository or the system using it.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the go-git library to version 5.19.1 or later, or to 6.0.0-alpha.4 or later, where the path validation issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in go-git allows crafted repository data to modify files outside the intended checkout target, including the repository's .git directory. This could potentially lead to unauthorized modification of files, which may impact data integrity and security controls.
However, there is no explicit information provided about how this vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying usage of vulnerable go-git versions (prior to 5.19.1 and 6.0.0-alpha.4) and checking for suspicious repository data that attempts path traversal outside the intended checkout target.
Since the vulnerability arises from crafted repository data exploiting path validation issues, you can detect it by:
- Checking the version of go-git in use to ensure it is 5.19.1 or later, or 6.0.0-alpha.4 or later.
- Scanning repositories for unusual file paths that attempt to write outside the repository directory, especially paths that traverse upwards (e.g., containing "../").
Suggested commands to check go-git version or scan for suspicious paths depend on your environment and usage, but examples include:
- To check go-git version in a Go project: `go list -m github.com/go-git/go-git` or check your go.mod file for the version.
- To find suspicious paths in repository data, you can search for path traversal patterns in repository files, for example using grep: `grep -r '\.\./' /path/to/repository`.
- Monitor logs or alerts for unexpected file modifications outside the repository directory, especially in the .git directory.
Ultimately, upgrading to the fixed versions is the recommended mitigation.