CVE-2026-71557: 
Packer vulnerability analysis and mitigation

CVE-2026-71557 is a path traversal vulnerability in go-git, an extensible Git implementation library written in pure Go, that allows maliciously crafted reference names to write files outside the intended reference storage directory. The vulnerability affects go-git versions prior to 5.19.2 and 6.0.0-alpha.1 through 6.0.0-alpha.4; versions 5.19.2 and 6.0.0-alpha.5 contain the fix. It was published on August 7, 2026, with the fix merged in July 2026. The CVSS v3.1 base score is 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-22: Path Traversal) lies in the dotgit reference storage layer of the storage/filesystem package, where reference names were used verbatim as filesystem paths without verifying that the resolved path remained within the .git/ reference storage directory. A crafted reference name such as refs/heads/../../config resolves to .git/config, allowing an attacker to overwrite or read arbitrary repository metadata. A malicious Git server can advertise such a reference name, and the name may survive refspec mapping (e.g., becoming refs/remotes/origin/../../config during a clone or fetch). The fix introduces a validReferenceName function at the dotgit storage entry points (SetRef, Ref, RemoveRef, and reflog methods) that rejects names with .. components, control characters, volume prefixes, and NTFS/HFS+ disguised traversal sequences (GitHub Advisory, PR #2247, PR #2254). A public PoC is available at GitHub PoC.

Successful exploitation allows an authenticated user with low privileges — who causes a go-git application to interact with a malicious Git server or process attacker-controlled reference names — to write arbitrary files outside the intended reference storage directory. The primary impact is high integrity loss, as critical repository metadata files such as .git/config or .git/HEAD can be overwritten, potentially enabling code execution or further system compromise. Availability is also partially affected, while confidentiality is not directly impacted. Only applications using filesystem-backed storage (storage/filesystem) are affected; those using the in-memory backend (storage/memory) are not (GitHub Advisory).

A public proof-of-concept exploit written in Go is available on GitHub, demonstrating the overwrite of .git/config via a crafted reference name (refs/heads/../../config) on vulnerable version v5.19.1 (Feedly). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0035 (low probability of exploitation in the near term). Exploitation requires user interaction (an application must interact with a malicious server) and low privileges, limiting opportunistic mass exploitation (GitHub Advisory).

1. Set up a malicious Git server: Configure a Git server to advertise a reference with a path-traversal name, such as refs/heads/../../config, pointing to an attacker-controlled commit hash.
2. Lure the target application: Cause a go-git application using filesystem-backed storage (storage/filesystem) to clone from or fetch from the malicious server. The traversal name may survive refspec mapping (e.g., becoming refs/remotes/origin/../../config).
3. Trigger reference storage: When go-git processes the advertised reference, the dotgit storage layer uses the reference name verbatim as a filesystem path under .git/, resolving refs/heads/../../config to .git/config.
4. Overwrite target file: The attacker-controlled content is written to .git/config (or another metadata file), potentially injecting malicious Git hooks or configuration to achieve code execution on the next Git operation.
5. Achieve code execution: If .git/config is overwritten with a configuration that defines a malicious core.hooksPath or similar directive, subsequent Git operations by the application or user may trigger attacker-controlled scripts (GitHub Advisory, GitHub PoC).

• File System: Unexpected modification timestamps on .git/config, .git/HEAD, or other top-level .git/ metadata files; presence of new or altered files directly under .git/ that do not correspond to normal reference storage paths.
• File System: Unexpected files or directories created outside the refs/ subtree within .git/, particularly files named config, index, packed-refs, or HEAD with unusual content.
• Logs: Application logs showing ErrReferenceNameEscape errors (if upgraded) or unexpected file write errors in the .git/ directory from go-git operations.
• Network: Outbound connections to unfamiliar or untrusted Git server addresses initiated by go-git-based applications, especially during clone or fetch operations.
• Process: Unexpected execution of scripts from .git/hooks/ or paths referenced in a modified .git/config, particularly if core.hooksPath has been altered (GitHub Advisory, GitHub PoC).

Upgrade go-git to version 5.19.2 (for v5 users) or 6.0.0-alpha.5 (for v6 alpha users) to receive the fix, which validates reference names at all dotgit storage entry points (GitHub Advisory). As a temporary workaround, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible. Applications that exclusively use storage/memory are not affected and require no action. Application-level validation of reference names before passing them to filesystem-backed go-git storage can serve as an additional interim mitigation but does not replace upgrading (GitHub Advisory, PR #2254).

The vulnerability was reported by @Saku0512, who also published the proof-of-concept, with the initial fix proposed by @Sahana2524 and finalized by go-git maintainer @pjbgf (GitHub Advisory). Downstream projects including Portainer (v2.39.6), pulumi-kubernetes, and Gitea runner have already issued dependency updates to incorporate the patched version, indicating broad awareness in the Go ecosystem (Feedly). The vulnerability has been detected by Nessus (plugin 333379) and indexed by OSV, GitLab advisories, and ENISA.