CVE-2026-71556

EUVD-2026-54526

07.08.2026, 17:17

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Link Following

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 29.42%

Debian Releases

Debian Product

Codename

golang-github-go-git-go-git

bookworm	postponed
forky	vulnerable
sid	vulnerable
trixie	no-dsa

golang-github-go-git-go-git-v6

forky	6.0.0~alpha.5-2 fixed
sid	6.0.0~alpha.5-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

golang-github-go-git-go-git

jammy	needs-triage
noble	needs-triage
resolute	needs-triage

golang-github-go-git-go-git-v6

jammy	dne
noble	dne
resolute	dne

openSUSE / SLES Releases

openSUSE Product

Release

amazon-ssm-agent

suse enterprise sap 15 SP4	3.3.5226.0-150000.5.40.1 fixed
suse enterprise sap 15 SP5	3.3.5226.0-150000.5.40.1 fixed
suse enterprise server 15 SP4	3.3.5226.0-150000.5.40.1 fixed
suse enterprise server 15 SP5	3.3.5226.0-150000.5.40.1 fixed

terraform-provider-aws

suse enterprise sap 15 SP4	3.11.0-150200.6.24.2 fixed
suse enterprise sap 15 SP5	3.11.0-150200.6.24.2 fixed
suse enterprise server 15 SP4	3.11.0-150200.6.24.2 fixed
suse enterprise server 15 SP5	3.11.0-150200.6.24.2 fixed

terraform-provider-azurerm

suse enterprise sap 15 SP4	2.32.0-150200.6.18.2 fixed
suse enterprise sap 15 SP5	2.32.0-150200.6.18.2 fixed
suse enterprise server 15 SP4	2.32.0-150200.6.18.2 fixed
suse enterprise server 15 SP5	2.32.0-150200.6.18.2 fixed

terraform-provider-external

suse enterprise sap 15 SP4	2.0.0-150200.6.18.2 fixed
suse enterprise sap 15 SP5	2.0.0-150200.6.18.2 fixed
suse enterprise server 15 SP4	2.0.0-150200.6.18.2 fixed
suse enterprise server 15 SP5	2.0.0-150200.6.18.2 fixed

terraform-provider-google

suse enterprise sap 15 SP4	3.43.0-150200.6.18.2 fixed
suse enterprise sap 15 SP5	3.43.0-150200.6.18.2 fixed
suse enterprise server 15 SP4	3.43.0-150200.6.18.2 fixed
suse enterprise server 15 SP5	3.43.0-150200.6.18.2 fixed

terraform-provider-helm

suse enterprise sap 15 SP4	2.9.0-150200.6.29.2 fixed
suse enterprise sap 15 SP5	2.9.0-150200.6.29.2 fixed
suse enterprise server 15 SP4	2.9.0-150200.6.29.2 fixed
suse enterprise server 15 SP5	2.9.0-150200.6.29.2 fixed

terraform-provider-kubernetes

suse enterprise sap 15 SP4	1.13.2-150200.6.18.2 fixed
suse enterprise sap 15 SP5	1.13.2-150200.6.18.2 fixed
suse enterprise server 15 SP4	1.13.2-150200.6.18.2 fixed
suse enterprise server 15 SP5	1.13.2-150200.6.18.2 fixed

terraform-provider-local

suse enterprise sap 15 SP4	2.0.0-150200.6.25.1 fixed
suse enterprise sap 15 SP5	2.0.0-150200.6.25.1 fixed
suse enterprise server 15 SP4	2.0.0-150200.6.25.1 fixed
suse enterprise server 15 SP5	2.0.0-150200.6.25.1 fixed

terraform-provider-null

suse enterprise sap 15 SP4	3.0.0-150200.6.24.2 fixed
suse enterprise sap 15 SP5	3.0.0-150200.6.24.2 fixed
suse enterprise server 15 SP4	3.0.0-150200.6.24.2 fixed
suse enterprise server 15 SP5	3.0.0-150200.6.24.2 fixed

terraform-provider-random

suse enterprise sap 15 SP4	3.0.0-150200.6.21.2 fixed
suse enterprise sap 15 SP5	3.0.0-150200.6.21.2 fixed
suse enterprise server 15 SP4	3.0.0-150200.6.21.2 fixed
suse enterprise server 15 SP5	3.0.0-150200.6.21.2 fixed

terraform-provider-tls

suse enterprise sap 15 SP4	3.0.0-150200.5.21.2 fixed
suse enterprise sap 15 SP5	3.0.0-150200.5.21.2 fixed
suse enterprise server 15 SP4	3.0.0-150200.5.21.2 fixed
suse enterprise server 15 SP5	3.0.0-150200.5.21.2 fixed

Azure Linux Releases

Azure Package

Release

packer

Azure Linux 3.0

0:1.9.5-19.azl3

fixed

Common Weakness Enumeration

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References

https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab

https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac

https://github.com/go-git/go-git/releases/tag/v5.19.2

https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5

https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm