CVE-2026-71557

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory, potentially leading to unauthorized file modification or data integrity issues.

This is a Moderate impact flaw because it requires user interaction and low privileges, but can lead to unauthorized file modification. The go-git library, when processing maliciously crafted reference names, fails to sanitize directory traversal sequences, allowing files to be written outside the intended directory. This could affect Red Hat products that utilize go-git for repository operations where untrusted input for reference names is processed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.