What is the CVSS score of CVE-2026-71557?

CVE-2026-71557 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-71557?

Yes, a public proof-of-concept exploit is available for CVE-2026-71557. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-71557?

Yes, a patch is available for CVE-2026-71557. Update the affected software to the latest version immediately.

go-git CVE-2026-71557

EUVD-2026-54527 MEDIUM

Path Traversal (CWE-22)

2026-08-07 GitHub_M

GHSA-qgq7-7hm3-q39j

Path Traversal Go Git

6.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Attacker needs only to host a malicious Git server (no privileges on victim system, so PR:N); client application must initiate a fetch/clone (UI:R); no confidentiality impact since only writes occur.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Aug 07, 2026 - 17:17 EUVD

Source Code Evidence Fetched

Aug 07, 2026 - 17:06 vuln.today

Analysis Generated

Aug 07, 2026 - 17:06 vuln.today

DescriptionCVE.org

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

AnalysisAI

Path traversal in go-git's filesystem-backed reference storage allows a malicious Git server to overwrite arbitrary files within the .git directory - including sensitive metadata like .git/config and .git/HEAD - by advertising crafted reference names containing .. sequences. Any application using go-git with the storage/filesystem package that clones from or fetches untrusted remote repositories is affected; versions prior to 5.19.2 (v5 branch) and 6.0.0-alpha.5 (v6 branch) are vulnerable. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward and requires only that an attacker control a Git server the victim application connects to.

Technical ContextAI

go-git (CPE: cpe:2.3:a:go-git:go-git) is a pure Go implementation of the Git protocol and storage layer, widely used in Go-based CI/CD tooling and developer utilities. Loose references in Git are stored as individual files under .git/<reference-name>, so the reference name directly maps to a filesystem path. The storage/filesystem/dotgit package previously used reference names as path components without resolving or validating them against the reference storage root, a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) root cause. A name like refs/heads/../../config resolves to .git/config on the host filesystem, escaping the intended storage subtree. The patch adds a validReferenceName() gate at every dotgit storage entry point that rejects names containing .. components, control characters, Windows volume prefixes, and HFS+/NTFS canonicalization disguises (e.g., .. , ..::$INDEX_ALLOCATION, Unicode ignored-codepoint variants), mirroring defenses already applied to submodule names in the same codebase. The in-memory storage backend (storage/memory) is unaffected because reference names are never resolved to filesystem paths in that implementation.

RemediationAI

The primary fix is to upgrade to go-git v5.19.2 (for the v5 module) or v6.0.0-alpha.5 (for the v6 module), both of which validate reference names at all dotgit storage entry points and reject names that escape the reference storage subtree. Patches are available via https://github.com/go-git/go-git/releases/tag/v5.19.2 and https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5. For applications that cannot immediately upgrade, the vendor recommends avoiding clones or fetches from untrusted Git servers until patching is possible - note this does not prevent exploitation if users can supply arbitrary remote URLs. Applications using exclusively storage/memory require no action. A temporary mitigation for applications using filesystem-backed storage is to validate reference names before passing them to go-git storage APIs; however, the vendor explicitly notes this is not a substitute for upgrading because application-level validation is harder to make comprehensive than the library-level fix, particularly for NTFS and HFS+ canonicalization edge cases. Switching to in-memory storage (storage/memory) eliminates the attack surface entirely but may not be architecturally feasible and removes persistence.

More in Go Git

View all

CVE-2026-71556 HIGH This Week POC

7.1 Aug 07

Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operation

CVE-2023-49569 CRITICAL Act Now

9.8 Jan 12

A path traversal vulnerability was discovered in go-git versions prior to v5.11. Rated critical severity (CVSS 9.8), thi

CVE-2023-49568 HIGH This Week

7.5 Jan 12

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. Rated high severity (CVSS 7.5)

CVE-2026-41506 MEDIUM This Month

4.7 May 08

go-git versions prior to 5.18.0 and 6.0.0-alpha.2 leak HTTP authentication credentials when following cross-host redirec

CVE-2026-25934 MEDIUM This Month

4.3 Feb 09

Corrupted Git pack and index files are not properly validated in go-git versions before 5.16.5, allowing an attacker to

CVE-2025-21614 HIGH This Month

7.5 Jan 06

go-git is a highly extensible git implementation library written in pure Go. Rated high severity (CVSS 7.5), this vulner

CVE-2025-21613 CRITICAL This Week

9.2 Jan 06

go-git is a highly extensible git implementation library written in pure Go. Rated critical severity (CVSS 9.2), this vu

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

Same technique Path Traversal

View all

CVE-2019-19781 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 12	Affected

CVE-2026-71557 vulnerability details – vuln.today

Back

go-git CVE-2026-71557

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Go Git

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code