Bug 2512557 (CVE-2026-71557)

Summary: CVE-2026-71557 github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, akhatavk, akoudelk, alinfoot, alizardo, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, aprice, asdas, asegurap, bniver, bparees, bsquizza, cahl, cmitchel, crizzo, dakwon, dfreiber, dhanak, dkeler, dpaolell, drosa, drow, dschmidt, dsimansk, dtrifiro, dymurray, eborisov, eglynn, elicohen, flucifre, gbenhaim, gmeno, gparvin, groman, gtanzill, hasun, hoberger, ibolton, jbalunas, jburrell, jbuscemi, jcantril, jchui, jdelft, jfula, jhe, jjoyce, jlanda, jmatthew, jmontleo, jowilson, jprabhak, jpretori, jsamir, jschluet, jupierce, kbempah, kingland, kshier, ktsao, lball, lbragsta, lchilton, lgamliel, lgarciaa, lhh, ljawale, lpele, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, msilmser, nboldt, ngough, niyer, nyancey, oaljalju, oezr, ometelka, pakotvan, pgaikwad, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, sakbas, sarad, sausingh, sbratsla, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, solenoci, sostapov, sprizend, sseago, stcannon, sthirugn, suppawar, syedriko, thason, tsze, twaugh, vereddy, veshanka, vkumar, vlaad, vvoronko, watson-tool-maintainers, weaton, wenshen, whayutin, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory, potentially leading to unauthorized file modification or data integrity issues.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-07 16:51:21 UTC 
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.