MEDIUM🇬🇧 English

CVE-2026-45571

CVSS 5.4v3.1pub. 2026-05-27upd. 2026-06-04

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

  • Go Git Project Go Git

    APP
    Go-Git Project
    6.0.0< 5.19.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
CWE
Referencje

Powiązane podatności

CVE-2025-21613CRITICAL9.2PL ✓ten sam produkt

Argument injection w bibliotece go-git — dowolne flagi git-upload-pack

CVE-2023-49569CRITICAL9.8PL ✓ten sam produkt

Path Traversal w go-git umożliwiający RCE (CVE-2023-49569)

CVE-2026-45022HIGH7.0ten sam produkt

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-g...

CVE-2025-21614HIGH7.5ten sam produkt

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnera...

CVE-2023-49568HIGH7.5ten sam produkt

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability a...