Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-08 | 1 | General1 |
| 2026-08-09 | 1 | PoC1 |
CVE-2026-71557 https://saku0512.com/cve/cve-2026-71557
Post summary
The provided information only names CVE-2026-71557 and gives a URL, lacking any details on exploitation, patching, or technical aspects.
CVE-2026-71557: go-git reference name path traversal PoC https://github.com/Saku0512/CVE-2026-71557-poc/blob/main/README.en.md
Post summary
A Proof of Concept for the path traversal vulnerability CVE-2026-71557 in go‑git is posted on GitHub, providing a public reference to the exploit code.