The vulnerability CVE-2026-71556 in github.com/go-git/go-git/v5 involves a symlink traversal issue in worktree operations. The worktreeFilesystem wrapper filtered dangerous path strings but did not prevent following existing symbolic links in the worktree path. This allowed an attacker who could introduce or control symlinks to cause writes to files outside the intended worktree, including the .git directory and its configuration files. For example, writing to a symlink pointing to .git/config could overwrite repository configuration. This affects filesystem-backed worktrees but not in-memory storage or memfs worktrees. The fix makes the worktree filesystem wrapper symlink-safe by rejecting any path where a symlink could cause escape from the worktree, including symlinks at the final path component.

An attacker able to place or control symbolic links in the worktree and trigger write operations can modify files outside the intended repository path, including critical Git metadata files such as .git/config. This can lead to unauthorized modification of repository configuration or other files, potentially impacting repository integrity. The vulnerability does not affect in-memory or memfs-backed worktrees. There are no known exploits in the wild.

A patch is available that makes the worktree filesystem wrapper symlink-safe by rejecting paths where symlinks could cause escape from the worktree location. Users of filesystem-backed worktrees should upgrade to a fixed version of go-git (versions >= 5.19.2 and excluding 6.0.0-alpha.5). No additional mitigation is required if using storage/memory or go-billy/memfs for worktrees.