CVE-2026-71557

EUVD-2026-54527

07.08.2026, 17:17

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Path Traversal

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 35.23%

Debian Releases

Debian Product

Codename

golang-github-go-git-go-git

bookworm	postponed
forky	vulnerable
sid	vulnerable
trixie	no-dsa

golang-github-go-git-go-git-v6

forky	6.0.0~alpha.5-2 fixed
sid	6.0.0~alpha.5-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

golang-github-go-git-go-git

jammy	needs-triage
noble	needs-triage
resolute	needs-triage

golang-github-go-git-go-git-v6

jammy	dne
noble	dne
resolute	dne

openSUSE / SLES Releases

openSUSE Product

Release

amazon-ssm-agent

suse enterprise sap 15 SP4	3.3.5226.0-150000.5.40.1 fixed
suse enterprise sap 15 SP5	3.3.5226.0-150000.5.40.1 fixed
suse enterprise server 15 SP4	3.3.5226.0-150000.5.40.1 fixed
suse enterprise server 15 SP5	3.3.5226.0-150000.5.40.1 fixed

terraform-provider-aws

suse enterprise sap 15 SP4	3.11.0-150200.6.24.2 fixed
suse enterprise sap 15 SP5	3.11.0-150200.6.24.2 fixed
suse enterprise server 15 SP4	3.11.0-150200.6.24.2 fixed
suse enterprise server 15 SP5	3.11.0-150200.6.24.2 fixed

terraform-provider-azurerm

suse enterprise sap 15 SP4	2.32.0-150200.6.18.2 fixed
suse enterprise sap 15 SP5	2.32.0-150200.6.18.2 fixed
suse enterprise server 15 SP4	2.32.0-150200.6.18.2 fixed
suse enterprise server 15 SP5	2.32.0-150200.6.18.2 fixed

terraform-provider-external

suse enterprise sap 15 SP4	2.0.0-150200.6.18.2 fixed
suse enterprise sap 15 SP5	2.0.0-150200.6.18.2 fixed
suse enterprise server 15 SP4	2.0.0-150200.6.18.2 fixed
suse enterprise server 15 SP5	2.0.0-150200.6.18.2 fixed

terraform-provider-google

suse enterprise sap 15 SP4	3.43.0-150200.6.18.2 fixed
suse enterprise sap 15 SP5	3.43.0-150200.6.18.2 fixed
suse enterprise server 15 SP4	3.43.0-150200.6.18.2 fixed
suse enterprise server 15 SP5	3.43.0-150200.6.18.2 fixed

terraform-provider-helm

suse enterprise sap 15 SP4	2.9.0-150200.6.29.2 fixed
suse enterprise sap 15 SP5	2.9.0-150200.6.29.2 fixed
suse enterprise server 15 SP4	2.9.0-150200.6.29.2 fixed
suse enterprise server 15 SP5	2.9.0-150200.6.29.2 fixed

terraform-provider-kubernetes

suse enterprise sap 15 SP4	1.13.2-150200.6.18.2 fixed
suse enterprise sap 15 SP5	1.13.2-150200.6.18.2 fixed
suse enterprise server 15 SP4	1.13.2-150200.6.18.2 fixed
suse enterprise server 15 SP5	1.13.2-150200.6.18.2 fixed

terraform-provider-local

suse enterprise sap 15 SP4	2.0.0-150200.6.25.1 fixed
suse enterprise sap 15 SP5	2.0.0-150200.6.25.1 fixed
suse enterprise server 15 SP4	2.0.0-150200.6.25.1 fixed
suse enterprise server 15 SP5	2.0.0-150200.6.25.1 fixed

terraform-provider-null

suse enterprise sap 15 SP4	3.0.0-150200.6.24.2 fixed
suse enterprise sap 15 SP5	3.0.0-150200.6.24.2 fixed
suse enterprise server 15 SP4	3.0.0-150200.6.24.2 fixed
suse enterprise server 15 SP5	3.0.0-150200.6.24.2 fixed

terraform-provider-random

suse enterprise sap 15 SP4	3.0.0-150200.6.21.2 fixed
suse enterprise sap 15 SP5	3.0.0-150200.6.21.2 fixed
suse enterprise server 15 SP4	3.0.0-150200.6.21.2 fixed
suse enterprise server 15 SP5	3.0.0-150200.6.21.2 fixed

terraform-provider-tls

suse enterprise sap 15 SP4	3.0.0-150200.5.21.2 fixed
suse enterprise sap 15 SP5	3.0.0-150200.5.21.2 fixed
suse enterprise server 15 SP4	3.0.0-150200.5.21.2 fixed
suse enterprise server 15 SP5	3.0.0-150200.5.21.2 fixed

Azure Linux Releases

Azure Package

Release

packer

Azure Linux 3.0

0:1.9.5-19.azl3

fixed

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7

https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36

https://github.com/go-git/go-git/pull/2247

https://github.com/go-git/go-git/pull/2254

https://github.com/go-git/go-git/releases/tag/v5.19.2

https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5

https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j