Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-07T17:17:10.833Z",
  "pubdate": "2026-08-07T17:17:10.833Z",
  "executiveSummary": "An arbitrary file write vulnerability exists within the go-git library, specifically affecting reference name handling. The flaw stems from a failure to properly sanitize reference names prior to using them in the construction of on-disk file paths within the reference storage directory. Consequently, a maliciously crafted reference name containing directory traversal sequences can be supplied to the library.\nThe primary impact of this vulnerability is arbitrary file write capability outside the intended reference storage directory. This allows an attacker capable of introducing malicious reference names to overwrite or create files on the host filesystem, subject to the permissions of the process executing the go-git library. This introduces critical risk implications, including potential remote code execution or system compromise if sensitive configuration files, binaries, or startup scripts are targeted.\nThe vulnerability affects go-git prior to versions 5.19.2 and 6.0.0-alpha.5. Exploitation requires an attacker to successfully inject or supply a malicious reference name containing path traversal sequences, such as dot-dot-slash patterns, to the vulnerable reference storage mechanism. No complex authentication or network exposure is inherently mandated by the vulnerability itself, as exploitation depends on how the library is integrated and whether untrusted reference inputs are processed.",
  "technicalDetails": "The root cause of the vulnerability resides in the reference storage component of the go-git library. Specifically, when processing reference names, the library fails to validate or sanitize input strings before concatenating them with base directory paths to instantiate on-disk files under the reference storage directory. Because input sanitization and validation checks are absent, strings containing directory traversal sequences (e.g., ../) are permitted to pass directly into path resolution routines.\nThe exploitation method relies on supplying a crafted git reference name containing traversal sequences. When the vulnerable component attempts to persist or interact with the reference on disk, the path construction mechanism resolves the traversal sequences, causing the resulting file operations to target directories outside the intended sandbox boundary of the reference storage directory.\nThe step-by-step attack flow proceeds as follows: First, an attacker crafts a malicious reference name incorporating relative path traversal tokens. Second, this reference name is introduced to the go-git library through repository operations that handle references. Third, the vulnerable reference storage component attempts to construct the filesystem path for the reference using the unsanitized input. Fourth, the path resolution mechanism navigates upward through the directory hierarchy outside the designated storage root. Fifth, the library performs a file write operation, resulting in the creation or overwriting of an arbitrary file on the underlying filesystem at the target location.\nThe affected components are the reference storage mechanisms within go-git prior to versions 5.19.2 and 6.0.0-alpha.5. The vulnerability manifests locally during reference processing workflows. The privileges required for exploitation are defined by the execution context of the application utilizing the go-git library, wherein any component processing untrusted git repositories or reference inputs may inadvertently trigger the insecure path construction behavior."
}