Bug 2498444

Summary: CVE-2026-45571 golang-github-git-5: go-git: Path validation flaw allows unauthorized file access [fedora-all]
Product: [Fedora] Fedora Reporter: Marian Rehak <mrehak>
Component: golang-github-git-5Assignee: Orphan Owner <extras-orphan>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 45CC: extras-orphan, go-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["e3c44eec-facc-44ac-8a24-f0a1f8bc21a2"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2482228    

Description Marian Rehak 2026-07-09 09:29:17 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
Comment 1 Aoife Moloney 2026-08-17 15:16:05 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.