CVE-2026-45571CWE-22

go-git: Crafted repositories may modify main and submodule .git directories

Medium · published May 27, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-27T14:57Z
EPSS history
Timeline
  • 27 MAY 14:57Z
    go-git: Crafted repositories may modify main and submodule .git directories
    cvelistv5