Saku0512/CVE-2026-71557-poc

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go proof-of-concept that exploits CVE-2026-71557, a path traversal vulnerability in go-git. It creates a temporary filesystem-backed Git storage, writes a marker to .git/config, then calls SetReference with a crafted reference name containing directory traversal sequences (refs/heads/../../config) to overwrite .git/config, demonstrating the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the CVE-2026-71557 path traversal vulnerability by calling the go-git API to overwrite a dummy .git/config file within a temporary directory. All operations are confined to a local sandbox, and no concealed executable behavior, persistence, credential theft, or unrelated payloads are present in the reviewed source code.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagesgo
Target softwarego-git
Attack typespath traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code directly exercises the vulnerable API (SetReference) with a malicious reference name to overwrite a file outside the intended directory, which is the definition of an exploit. It does not merely check for the vulnerability; it actively triggers the path traversal to modify .git/config.

poc.go:18poc.go:62-63poc.go:83-85README.en.md:7-8

Requirements

  • Go 1.25 or later, or a Go installation with automatic toolchain downloadREADME.en.md:65-66
  • Network access for the initial module downloadREADME.en.md:66

Observed behavior

  • Creates a temporary directory and initializes filesystem-backed Git storagepoc.go:37-55
  • Writes a harmless marker to .git/configpoc.go:57-60
  • Calls SetReference with a crafted reference name containing path traversal (refs/heads/../../config) to overwrite .git/configpoc.go:18poc.go:62-63
  • Verifies that the reference hash replaced the marker, confirming the vulnerabilitypoc.go:64-71poc.go:83-85
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Path Traversal Payload
refs/heads/../../configCrafted reference name used to trigger the vulnerability and overwrite .git/config.poc.go:18
Temporary Directory Usage
os.MkdirTemp("", "cve-2026-71557-")The PoC creates a temporary directory for the test repository, isolating its effects from the host system.poc.go:37
Cleanup Behavior
defer os.RemoveAll(sandbox)The temporary directory is automatically removed unless the -keep flag is used, preventing persistent changes.poc.go:44
Review boundaries

What the analysis did not establish

  • Two files (scripts/run-version-matrix.sh and one other) are omitted from the evidence; their content is not provided.
  • The evidence does not include the go.sum file, which may be needed to verify module integrity.
  • The PoC targets a local temporary directory and does not demonstrate the full attack chain involving a malicious Git server.
  • Two text files (scripts/run-version-matrix.sh and go.sum) were omitted from the evidence packet and were not reviewed.
  • The review is limited to static analysis of the provided source code; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1