THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-hc8v-wwc9-vgxm (high) — go-git: Worktree operations may follow symlinks

[GHSA] GHSA-hc8v-wwc9-vgxm (high) — go-git: Worktree operations may follow symlinks

medgithub_advisoriesPublished 2026-08-07

GHSA-hc8v-wwc9-vgxm Severity: high CVE: CVE-2026-71556

go-git: Worktree operations may follow symlinks

## Impact

A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.

The `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However,

Indicators of compromise

CVE-2026-71556cve

Original source: https://github.com/advisories/GHSA-hc8v-wwc9-vgxm