Executive brief
A vulnerability in the go-git library, which is used by applications to interact with Git repositories, could allow a malicious Git server to manipulate files on a user's system. By providing specially crafted reference names during a clone or fetch operation, an attacker can write data to locations outside the intended storage area, potentially corrupting repository configuration or other sensitive metadata. This risk primarily affects applications that store Git data on a local disk rather than in memory.
Technical details
A path traversal vulnerability (CWE-22) exists in go-git's 'dotgit' reference storage implementation within the storage/filesystem package. The library fails to validate that resolved paths for loose references remain within the .git directory, allowing reference names containing traversal sequences (e.g., 'refs/heads/../../config') to resolve to sensitive files like .git/config. An attacker controlling a Git server can exploit this during clone or fetch operations by advertising malicious reference names. The issue is fixed in versions 5.19.2 and 6.0.0-alpha.5 by implementing strict validation at storage entry points.
Affected products
- go-git go-git/v5 <= 5.19.1
- go-git go-git/v6 <= 6.0.0-alpha.4
Timeline
- 2026-07-30: patched: Fixes released in v5.19.2 and v6.0.0-alpha.5
- 2026-08-07: advisory: GitHub Advisory GHSA-qgq7-7hm3-q39j published