CVE-2026-71557

MEDIUM

go-git: Malicious reference names may modify files outside the reference storage

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-71557. PoCs published by Saku0512.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-71557, a path traversal vulnerability in go-git's filesystem storage. The PoC demonstrates how a crafted reference name (e.g., `refs/heads/../../config`) can overwrite `.git/config` by exploiting insufficient validation in the `SetReference` API.

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Exploits (1)

github WORKING POC

by Saku0512 · gopoc

https://github.com/Saku0512/CVE-2026-71557-poc

View Code ZIP pw:eip

This repository contains a functional proof-of-concept for CVE-2026-71557, a path traversal vulnerability in go-git's filesystem storage. The PoC demonstrates how a crafted reference name (e.g., `refs/heads/../../config`) can overwrite `.git/config` by exploiting insufficient validation in the `SetReference` API.

Classification

Working Poc 99%

Attack Type

Other

Complexity

Trivial

Reliability

Reliable

Target: github.com/go-git/go-git/v5 <= 5.19.1, github.com/go-git/go-git/v6 <= 6.0.0-alpha.4

No auth needed

Prerequisites: Local or remote interaction with a vulnerable go-git version (e.g., via a malicious Git server or crafted repository)

MITRE ATT&CK