5.4
CVE-2026-45571
- EPSS 0.3%
- Veröffentlicht 27.05.2026 15:16:30
- Zuletzt bearbeitet 04.06.2026 18:01:41
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Logingo-git: Crafted repositories may modify main and submodule .git directories
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Go-git Project ≫ Go-git SwPlatformgo Version < 5.19.1
Go-git Project ≫ Go-git Version6.0.0 Updatealpha1 SwPlatformgo
Go-git Project ≫ Go-git Version6.0.0 Updatealpha2 SwPlatformgo
Go-git Project ≫ Go-git Version6.0.0 Updatealpha3 SwPlatformgo
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.211 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96