## https://sploitus.com/exploit?id=6D98B2BD-6591-56E2-81ED-D747E58F3266
# CVE-2026-71557: Go-Git path traversal PoC
[English version](README.en.md)
## Summary
This repository contains a secure local PoC for CVE-2026-71557, based on the public advisories of go-git:
[GHSA-qgq7-7hm3-q39j](https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j)
Before the fix, the `storage/filesystem` module used paths like `.git/` without proper validation of reference names. This allowed references like `refs/heads/../../config` to be normalized to `..`, potentially overwriting the `.git/config` file located outside the intended reference storage. This PoC targets the actual go-git API, specifically the dummy `.git/config` files created in temporary directories. Connections to external Git servers, modifications to existing repositories, or execution of arbitrary commands are not performed.
## Exclusions
This project is intended solely for educational purposes and approved ethical security testing. Do not use this tool in unauthorized environments.
## Details of the Vulnerability
- **CVE ID**: CVE-2026-71557
- **GitHub Advisory**: GHSA-qgq7-7hm3-q39j
- **Type**: Path Traversal (CWE-22)
- **Score**: Medium
- **CVSS v3.1**: 6.3 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L`)
- **Affected Versions**:
- `github.com/go-git/go-git/v5`
[!] VULNERABLE: `.git/config` was overwritten through the reference name.
The PoC performs the following steps:
1. Create a filesystem-backed Git storage in a temporary directory on the OS.
2. Write a safe marker to `.git/config`.
3. Pass the reference `refs/heads/../../config` to `SetReference`.
4. Verify that the marker has been replaced by the reference hash.
5. Automatically delete the temporary directory.
### Comparison between Vulnerable and Fixed Versions
The following script runs the same PoC on versions v5.19.1 and v5.19.2, without modifying the `go.mod` file or using temporary modules. ```bash
./scripts/run_version_matrix.sh
```
Expected Output:
```
go-git v5.19.1
[!] VULNERABLE: .git/config was overwritten through the reference name. go-git v5.19.2
[+] FIXED: the crafted reference was rejected and .git/config stayed intact.
```
To check the temporary files, add the `-keep` option. Note that the directories will not be automatically deleted; please remove them manually after checking. ```bash
go run . -keep
```
## Scope of the PoC
This PoC directly exploits the vulnerable entry points of the filesystem storage described in the advisories. It tests the potential for metadata overwriting through path traversal. No malicious Git protocol server or transport layer is implemented.
## Mitigations
Users running v5 should update to v5.19.2 or later. Users of v6 alpha should update to v6.0.0-alpha.5 or later. During the update period, avoid cloning/fetching from insecure Git servers that use filesystem-backed storage. Applications that only use `storage/memory` are not affected by this vulnerability.
## References
- [GHSA-qgq7-7hm3-q39j](https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j)
- [go-git PR #2247 (v6 fix)](https://github.com/go-git/go-git/pull/2247)
- [go-git PR #2254 (v5 backport)](https://github.com/go-git/go-git/pull/2254)
- [v5 fix commit f3d0cc1](https://github.com/go-git/go-git/commit/f3d0cc150b39ae1dc47406a5c170464286914610)
- [v5 additional safety commit 3b306ef](https://github.com/go-git/go-git/commit/3b306ef83bd05194a30ce820eed7ed61c3084b5f)