CVE-2026-71556: 
Packer vulnerability analysis and mitigation

CVE-2026-71556 is a symlink traversal vulnerability in go-git, an extensible Git implementation library written in pure Go, that allows worktree operations (checkout, status, add) to follow symbolic links outside the intended working directory boundary. Discovered and reported by @kodareef5 (with an independent report from @HughLewis20), the advisory was published on August 7, 2026. Affected versions include all releases of github.com/go-git/go-git/v5 up to and including 5.19.1, and v6 alpha releases from 6.0.0-alpha.1 through 6.0.0-alpha.4. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). The worktreeFilesystem wrapper in go-git validated path strings for dangerous patterns (e.g., .git, .., control characters) but did not check whether any path component on disk was itself a symbolic link. As a result, a path that passed string-level validation could still resolve through a symlink into the repository's .git metadata directory or other locations outside the worktree. Two concrete attack scenarios exist: (1) a symlink s pointing to .git allows writing to s/config, which resolves to .git/config; and (2) a symlink s pointing directly to .git/config allows overwriting that file via OpenFile with O_TRUNC. The fix introduces validNoLeadingSymlink (rejecting paths with symlinked leading components) and validWritePath/validReadPath wrappers applied to all filesystem operations, mirroring upstream Git's has_symlink_leading_path in symlinks.c (GitHub Advisory, Patch Commit v5, Patch Commit v6).

Successful exploitation allows an attacker to write to or read from files outside the intended worktree boundary, most critically the repository's .git metadata directory. This enables modification of Git configuration files (e.g., .git/config), which can lead to repository corruption, injection of malicious hooks, or manipulation of remote URLs to facilitate further attacks. Integrity impact is rated High, with a Low availability impact; confidentiality is not directly impacted. Applications using in-memory storage (storage/memory or go-billy/memfs) are not affected (GitHub Advisory).

Exploitation requires user interaction — a victim must clone or perform worktree operations on a maliciously crafted repository containing planted symlinks. No privileges are required on the attacker's side, and the attack is network-delivered. There is no public proof-of-concept exploit code or evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.0029 (0.29%), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment classifies exploitation as 'none' (GitHub Advisory, Feedly).

1. Craft a malicious repository: Create a Git repository containing a tracked symbolic link — for example, a symlink named s pointing to .git, or a symlink named s pointing directly to .git/config.
2. Host the repository: Make the malicious repository available via a public or targeted Git hosting service (e.g., GitHub, self-hosted).
3. Induce the victim to clone: Social-engineer or otherwise cause a target application or developer using go-git (versions ≤ 5.19.1 or 6.0.0-alpha.1 through 6.0.0-alpha.4) to clone the repository.
4. Trigger worktree operations: The vulnerability is triggered during checkout, status, or add operations. Cloning alone typically triggers checkout, which materializes the symlink into the worktree.
5. Achieve out-of-boundary write: When go-git performs a subsequent write operation through the symlinked path (e.g., writing to s/config), the worktreeFilesystem wrapper validates the string s/config as safe but does not detect that s is a symlink to .git. The write lands in .git/config, overwriting repository configuration.
6. Leverage the write: With control over .git/config, an attacker can inject malicious Git hooks, redirect remotes, or corrupt repository state to achieve further compromise (GitHub Advisory, Patch Commit v5).

• File System: Unexpected symbolic links in the worktree directory pointing to .git or subdirectories/files within .git (e.g., a file named s with readlink s returning .git or .git/config); unexpected modifications to .git/config (check mtime or diff against known-good state); presence of unexpected Git hooks in .git/hooks/ with executable permissions.
• Logs: Application logs from go-git-based tools showing worktree operations on repositories from untrusted or external sources; unexpected file write errors or permission errors referencing .git paths during checkout.
• Process: Unexpected execution of scripts or binaries from .git/hooks/ (e.g., pre-commit, post-checkout) triggered after cloning an external repository.

Upgrade to go-git v5.19.2 (for the v5 branch) or v6.0.0-alpha.5 (for the v6 alpha branch), which make the worktreeFilesystem wrapper a symlink-safe boundary by rejecting paths with symlinked leading components on all read and write operations. No configuration-based workaround is available for filesystem-backed worktrees; the only mitigation is upgrading. Applications using storage/memory or go-billy/memfs are not affected and do not require action (v5.19.2 Release, v6.0.0-alpha.5 Release).

The vulnerability was acknowledged by the go-git security team and credited to two independent reporters (@kodareef5 and @HughLewis20). Downstream projects including Portainer (v2.39.6) and pulumi-kubernetes have already issued dependency updates to incorporate the patched go-git version, indicating prompt uptake in the ecosystem (Portainer Release, pulumi-kubernetes Commit). GitLab's advisory tracker and OSV.dev have also indexed the vulnerability, reflecting broad community awareness.