go-git CVE-2026-71556

CWE-59 (Improper Link Resolution Before File Access / Link Following) describes the root cause: a security wrapper validated path strings without enforcing that filesystem operations could not follow already-present symbolic links into restricted locations. The go-git worktreeFilesystem abstraction used by all filesystem-backed worktrees (CPE: cpe:2.3:a:go-git:go-git:*:*:*:*:*:*:*:*) rejected dangerous string patterns - .git references, parent-directory components (..), control characters - but did not prevent OS-level symlink resolution during file creation or opening. Two distinct attack shapes exist: (1) a symlink at a leading path component (e.g., 's' -> '.git'), causing writes to 's/config' to land in '.git/config'; (2) a symlink at the final path component (e.g., 's' -> '.git/config'), causing O_TRUNC opens to overwrite the symlink target. The fix introduced a clearBlockingSymlinks function that uses Lstat to detect and remove blocking symlinks before materializing entries, and added validNoLeadingSymlink checks to the worktreeFilesystem boundary for both read and write paths. Applications using storage/memory or go-billy/memfs are architecturally exempt because they never perform real filesystem operations.