CVE-2026-71557: 
Packer 脆弱性の分析と軽減

CVE-2026-71557 is a path traversal vulnerability in go-git, an extensible Git implementation library written in pure Go, that allows maliciously crafted reference names to write files outside the intended reference storage directory. The vulnerability affects go-git versions prior to 5.19.2 and 6.0.0-alpha.1 through 6.0.0-alpha.4. It was reported by @Saku0512, disclosed via GitHub Advisory GHSA-qgq7-7hm3-q39j on August 7, 2026, and patched in versions 5.19.2 and 6.0.0-alpha.5. It carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory).

The root cause (CWE-22: Path Traversal) lies in the dotgit reference storage layer of the storage/filesystem package, where reference names were used verbatim to construct on-disk paths under .git/ without validating that the resolved path remained within the reference storage directory. A crafted reference name such as refs/heads/../../config resolves to .git/config, allowing an attacker to overwrite arbitrary repository metadata. A malicious Git server can advertise such a reference name, and it may survive refspec mapping (e.g., becoming refs/remotes/origin/../../config during a clone or fetch). The fix introduces a validReferenceName function at the dotgit storage entry points (SetRef, Ref, RemoveRef, and reflog methods) that rejects names with .. components, control characters, volume prefixes, and NTFS/HFS+ disguised traversal sequences (GitHub PR #2247, GitHub PR #2254). Only filesystem-backed repositories using storage/filesystem are affected; users of the in-memory storage/memory backend are not impacted (GitHub Advisory).

Successful exploitation allows an authenticated attacker with low privileges to write arbitrary files outside the .git/refs/ directory, potentially overwriting critical repository metadata such as .git/config or .git/HEAD. This can lead to integrity compromise of the repository, potential code execution if configuration files are manipulated to inject malicious hooks or settings, and limited availability impact. Confidentiality is not directly impacted, as the vulnerability is write-oriented rather than read-oriented (GitHub Advisory).

A public proof-of-concept exploit is available on GitHub at https://github.com/Saku0512/CVE-2026-71557-poc, consisting of a runnable Go program (poc.go) that demonstrates overwriting .git/config via the crafted reference name refs/heads/../../config on vulnerable go-git v5.19.1. Exploitation requires user interaction (a user must interact with a malicious repository) and low-level privileges, making it less trivially weaponizable. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0035 (low probability of exploitation in the near term) (GitHub Advisory, Feedly).

1. Set up a malicious Git server: Configure a Git server to advertise a reference with a path-traversal name, such as refs/heads/../../config, pointing to an attacker-controlled commit hash.
2. Lure the victim application: Cause a go-git application using filesystem-backed storage (storage/filesystem) to clone from or fetch from the malicious server. The traversal reference name may survive refspec mapping (e.g., becoming refs/remotes/origin/../../config).
3. Trigger reference storage: When go-git processes the advertised reference and calls SetRef on the dotgit storage layer, the unvalidated reference name is used verbatim as a filesystem path under .git/.
4. Achieve arbitrary file write: The crafted name resolves outside the reference storage directory — for example, refs/heads/../../config resolves to .git/config — allowing the attacker to overwrite repository metadata with attacker-controlled content.
5. Escalate impact: By overwriting .git/config, an attacker could inject malicious Git hooks (e.g., core.hooksPath) or alter remote URLs, potentially achieving code execution when the victim subsequently runs Git operations (GitHub Advisory, PoC Repository).

• File System: Unexpected modification timestamps on .git/config, .git/HEAD, or other top-level .git/ metadata files; presence of files in .git/ that do not correspond to legitimate reference names (e.g., files outside refs/ subdirectories created by go-git operations).
• Logs: Application logs showing ErrReferenceNameEscape errors (on patched versions) or unexpected reference names containing .. components being processed; Git operation logs referencing unusual remote reference names.
• Network: Outbound connections to unfamiliar or untrusted Git server endpoints from applications using go-git with filesystem-backed storage; server-side logs showing advertisement of reference names containing ../ sequences.
• Process: Unexpected execution of Git hooks (e.g., pre-receive, post-checkout) following a clone or fetch operation from an untrusted remote, which may indicate .git/config was tampered with to redirect hook paths (GitHub Advisory).

Upgrade go-git to version 5.19.2 (for v5 users) or 6.0.0-alpha.5 (for v6 alpha users) to receive the fix, which validates reference names at all dotgit storage entry points (GitHub Advisory). As a temporary workaround, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible. Applications that exclusively use storage/memory are not affected and require no action. Applications that directly construct or process reference names may implement application-level validation as a temporary measure, but this does not replace upgrading to a patched version (GitHub PR #2254).

The fix was developed collaboratively: @Saku0512 reported the issue and published a PoC, @Sahana2524 proposed the initial fix (PR #2247 for v6), and go-git maintainer @pjbgf backported and hardened the fix for v5 (PR #2254), adding additional protections against NTFS and HFS+ disguised traversal sequences. The advisory credits both the reporter and the fix contributor, reflecting a coordinated disclosure process. Nessus detection plugin 333379 was released to help identify vulnerable installations (GitHub Advisory, Tenable).