GHSA-hc8v-wwc9-vgxmPublished

go-git: Worktree operations may follow symlinks

Exploitation and risk

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2026-71556

Published

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Source published: 7 Aug 2026 16:37:40 UTC
Source modified: 7 Aug 2026 16:58:19 UTC
Saved here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

euvd · EUVD-2026-54526

Published

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Aug 7, 2026, 4:37:40 PM

dateUpdated: Aug 7, 2026, 4:58:19 PM

49 related source bulletins · separate from aliases

RHSA-2026:67540: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update

CVE-2025-53547 · CVE-2026-41178 · CVE-2026-42151 · CVE-2026-48586 · CVE-2026-55969 · CVE-2026-56852 · CVE-2026-66780 · CVE-2026-71556 · CVE-2026-73646 · CVE-2026-89060

WID-SEC-W-2026-4175: Red Hat OpenShift GitOps (go-git): Schwachstelle ermöglicht Manipulation von Dateien

CVE-2026-71556

openSUSE-SU-2026:11694-1: amazon-ssm-agent-3.3.5226.0-1.1 on GA media

CVE-2025-22869 · CVE-2026-25934 · CVE-2026-71556

RHSA-2026:67543: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.17.2 security update

CVE-2026-41178 · CVE-2026-45570 · CVE-2026-56852 · CVE-2026-66780 · CVE-2026-71556 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-89060

RHSA-2026:60793: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-71556

openSUSE-SU-2026:22032-1: Security update for alloy

CVE-2026-2303 · CVE-2026-37236 · CVE-2026-41178 · CVE-2026-45679 · CVE-2026-45680 · CVE-2026-45681 · CVE-2026-45683 · CVE-2026-45684 · CVE-2026-46600 · CVE-2026-48496 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-56855 · CVE-2026-71556 · CVE-2026-71557 · CVE-2026-75889 · CVE-2026-78662 · CVE-2026-81521 · CVE-2026-89090

RHSA-2026:73380: Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

CVE-2026-71556

RHSA-2026:94072: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.3 release.

CVE-2024-45336 · CVE-2025-22866 · CVE-2025-47907 · CVE-2026-44740 · CVE-2026-56852 · CVE-2026-71556

RHSA-2026:67538: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update

CVE-2026-27136 · CVE-2026-41178 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42502 · CVE-2026-48586 · CVE-2026-55969 · CVE-2026-56852 · CVE-2026-66780 · CVE-2026-71556 · CVE-2026-73646

RHSA-2026:90323: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.9 security update

CVE-2026-71556

RHSA-2026:94094: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.3 release.

CVE-2026-44740 · CVE-2026-56852 · CVE-2026-71556

RHSA-2026:94074: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.2 release.

CVE-2024-45336 · CVE-2025-22866 · CVE-2025-47907 · CVE-2026-44740 · CVE-2026-56852 · CVE-2026-71556

RHSA-2026:67541: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update

CVE-2025-53547 · CVE-2026-41178 · CVE-2026-42154 · CVE-2026-42502 · CVE-2026-48586 · CVE-2026-55969 · CVE-2026-56852 · CVE-2026-66780 · CVE-2026-71556 · CVE-2026-89060

RHSA-2026:94071: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.3 release.

CVE-2026-44740 · CVE-2026-56852 · CVE-2026-71556

RHSA-2026:94070: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.13.2 release.

CVE-2024-45336 · CVE-2025-22866 · CVE-2025-47907 · CVE-2026-44740 · CVE-2026-56852 · CVE-2026-71556

RHSA-2026:66421: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-15789 · CVE-2026-71556

RHSA-2026:66208: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-71556 · CVE-2026-71557

RHSA-2026:74609: Red Hat Security Advisory: Cluster Observability Operator 1.5.3

CVE-2026-19534 · CVE-2026-39244 · CVE-2026-41178 · CVE-2026-42504 · CVE-2026-45623 · CVE-2026-56864 · CVE-2026-56865 · CVE-2026-59887 · CVE-2026-63199 · CVE-2026-71556 · CVE-2026-73086 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-84292 · CVE-2026-84394 · CVE-2026-84445 · CVE-2026-84961 · CVE-2026-92000 · CVE-2026-100690

RHSA-2026:67539: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update

CVE-2025-47907 · CVE-2026-33377 · CVE-2026-41178 · CVE-2026-42154 · CVE-2026-48586 · CVE-2026-55969 · CVE-2026-56852 · CVE-2026-59879 · CVE-2026-66780 · CVE-2026-71556 · CVE-2026-89060

SUSE-SU-2026:4286-1: Security update for amazon-ssm-agent

CVE-2026-56854 · CVE-2026-56855 · CVE-2026-71556 · CVE-2026-71557 · CVE-2026-78662

RHSA-2026:70828: Red Hat Security Advisory: RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release

CVE-2026-41178 · CVE-2026-56854 · CVE-2026-71556 · CVE-2026-73500

RHSA-2026:50953: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-71556 · CVE-2026-75593

openSUSE-SU-2026:21884-1: Security update for amazon-ssm-agent

CVE-2026-56854 · CVE-2026-56855 · CVE-2026-71556 · CVE-2026-71557 · CVE-2026-78662

RHSA-2026:67542: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update

CVE-2026-41178 · CVE-2026-42154 · CVE-2026-48586 · CVE-2026-55969 · CVE-2026-56852 · CVE-2026-66780 · CVE-2026-71556 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-89060

RHSA-2026:69539: Red Hat Security Advisory: RHOAI 3.5.1 - Red Hat OpenShift AI

CVE-2026-19913 · CVE-2026-54284 · CVE-2026-56859 · CVE-2026-59893 · CVE-2026-62384 · CVE-2026-69243 · CVE-2026-69244 · CVE-2026-71491 · CVE-2026-71556 · CVE-2026-76222 · CVE-2026-79674 · CVE-2026-80205 · CVE-2026-81722 · CVE-2026-81724 · CVE-2026-81727

RHSA-2026:83597: Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

CVE-2026-41178 · CVE-2026-56854 · CVE-2026-71556 · CVE-2026-73500 · CVE-2026-84445

RHSA-2026:73194: Red Hat Security Advisory: OpenShift Virtualization v4.12 Images

CVE-2026-71556

RHSA-2026:73399: Red Hat Security Advisory: OpenShift Virtualization v4.18 Images

CVE-2026-71556

RHSA-2026:73262: Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

CVE-2026-71556

openSUSE-SU-2026:11803-1: alloy-1.19.2-1.1 on GA media

CVE-2026-2303 · CVE-2026-37236 · CVE-2026-41178 · CVE-2026-45679 · CVE-2026-45680 · CVE-2026-45681 · CVE-2026-45683 · CVE-2026-45684 · CVE-2026-46600 · CVE-2026-48496 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-71556 · CVE-2026-71557 · CVE-2026-75889 · CVE-2026-75890 · CVE-2026-81521 · CVE-2026-89090

RHSA-2026:73197: Red Hat Security Advisory: OpenShift Virtualization v4.14 Images

CVE-2026-71556

RHSA-2026:68334: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update

CVE-2026-25681 · CVE-2026-27136 · CVE-2026-27145 · CVE-2026-33810 · CVE-2026-33818 · CVE-2026-39820 · CVE-2026-39831 · CVE-2026-41178 · CVE-2026-42306 · CVE-2026-42499 · CVE-2026-42504 · CVE-2026-44740 · CVE-2026-46597 · CVE-2026-48050 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-69153 · CVE-2026-71556 · CVE-2026-81521

RHSA-2026:73165: Red Hat Security Advisory: OpenShift Virtualization v4.22 Images

CVE-2026-71556

msrc_CVE-2026-71556: go-git: Worktree operations may follow symlinks

CVE-2026-71556

RHSA-2026:94073: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.2 release.

CVE-2026-44740 · CVE-2026-56852 · CVE-2026-71556

RHSA-2026:93938: Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

CVE-2026-71556

RHSA-2026:68253: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update

CVE-2026-6377 · CVE-2026-13149 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-39820 · CVE-2026-39831 · CVE-2026-41178 · CVE-2026-42306 · CVE-2026-42499 · CVE-2026-44740 · CVE-2026-45819 · CVE-2026-46597 · CVE-2026-48050 · CVE-2026-50162 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-59869 · CVE-2026-69152 · CVE-2026-71556 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73643 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-81521 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394

RHSA-2026:73193: Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

CVE-2026-71556

RHSA-2026:60646: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-71556

SUSE-SU-2026:24148-1: Security update for alloy

RHSA-2026:90337: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.21.6 security update

CVE-2026-71556 · CVE-2026-84375

RHSA-2026:69928: Red Hat Security Advisory: Red Hat OpenShift Builds 1.8.2

CVE-2026-33818 · CVE-2026-41178 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56854 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-71556

RHSA-2026:68006: Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update

CVE-2026-6377 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-17106 · CVE-2026-27145 · CVE-2026-33818 · CVE-2026-41178 · CVE-2026-44740 · CVE-2026-45819 · CVE-2026-48050 · CVE-2026-50162 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-59869 · CVE-2026-69152 · CVE-2026-71556 · CVE-2026-73089 · CVE-2026-73643 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-81521 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394

RHSA-2026:68254: Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update

RHSA-2026:68335: Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update

CVE-2026-27145 · CVE-2026-33818 · CVE-2026-41178 · CVE-2026-44740 · CVE-2026-48050 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-71556

RHSA-2026:73261: Red Hat Security Advisory: OpenShift Virtualization v4.16 Images

CVE-2026-71556

RHSA-2026:69945: Red Hat Security Advisory: Red Hat OpenShift Builds 1.8.2

CVE-2026-33818 · CVE-2026-41178 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56854 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-71556

RHSA-2026:66363: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.2.1

CVE-2026-33818 · CVE-2026-41178 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-71556

RHSA-2026:68044: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update

CVE-2026-6377 · CVE-2026-13149 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-27145 · CVE-2026-33818 · CVE-2026-39820 · CVE-2026-39831 · CVE-2026-41178 · CVE-2026-42306 · CVE-2026-42499 · CVE-2026-42504 · CVE-2026-44740 · CVE-2026-45819 · CVE-2026-46597 · CVE-2026-48050 · CVE-2026-50162 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-59869 · CVE-2026-69152 · CVE-2026-71556 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73643 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-81521 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394

Source published: Aug 7, 2026, 4:37:40 PM (timezone not stated)
Source modified: Aug 7, 2026, 4:58:19 PM (timezone not stated)
Saved here: 13 Nov 2026 17:02:48 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

nvd · CVE-2026-71556

Published

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-59

Original publisher date fields

published: 2026-08-07T17:17:10.150

lastModified: 2026-09-10T20:41:33.140

Source published: 7 Aug 2026 17:17:10 UTC
Source modified: 10 Sep 2026 20:41:33 UTC
Saved here: 25 Oct 2026 15:18:57 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

osv · GHSA-hc8v-wwc9-vgxm

Published

## Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path. The `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree. As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`. A symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration. Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path. Applications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability. ## Patches The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary. Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component. Users of filesystem-backed worktrees should upgrade to a patched version. ### Credits Thanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. :1st_place_medal: We would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.

Source published: 7 Aug 2026 16:38:15 UTC
Source modified: 10 Sep 2026 03:51:14 UTC
Saved here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Publisher rating · HIGH

osv · GO-2026-6213

Published

Worktree operations may follow symlinks in github.com/go-git/go-git

Source published: 18 Aug 2026 16:38:10 UTC
Source modified: 1 Sep 2026 03:55:58 UTC
Saved here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.