CVE-2026-45571
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
May 27, 2026
CISA due date
—
The record
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | flux2-cli | 0 | 2.8.8-1.1 |
Related vulnerabilities
- CVE-2026-45570 go-git is an extensible git implementation library written in pure Go. Also affects flux2-cli
- CVE-2026-45022 go-git is an extensible git implementation library written in pure Go. Also affects flux2-cli
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22
- CVE-2026-61702 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-22
- CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. CWE-22
- CVE-2026-102991 Mako is a template library written in Python. CWE-22