Executive brief
A vulnerability in the go-git library, which is used by applications to interact with Git repositories, could allow an attacker to modify files outside of the intended project directory. By tricking an application into writing to a specially crafted symbolic link, an attacker could overwrite critical system files or the repository's own configuration. This could lead to unauthorized data modification or a disruption of service.
Technical details
A symlink traversal vulnerability (CWE-59) exists in go-git's worktree implementation. While the `worktreeFilesystem` wrapper successfully validated path strings for dangerous components like '..' or '.git', it failed to prevent the underlying filesystem from following existing symbolic links within the worktree. An attacker who can introduce a symbolic link into the repository can cause subsequent write operations to resolve to paths outside the worktree, such as the `.git/config` file or other sensitive system locations. This issue affects filesystem-backed worktrees and has been patched in versions 5.19.2 and 6.0.0-alpha.5 by enforcing symlink-safe boundaries during path resolution.
Affected products
- go-git go-git/v5 <= 5.19.1
- go-git go-git/v6 <= 6.0.0-alpha.4
Timeline
- 2026-07-30: disclosed
- 2026-08-07: advisory: GitHub Advisory published