High [CVE-2026-71556] Arbitrary file read/write via symbolic link resolution

go-git is an extensible git implementation library written in pure Go.

Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used.

This could result in information disclosure or arbitrary file modification. Exploitation requires the application to clone an attacker-controlled repository and then perform worktree operations against it; applications that only process trusted repositories are not exposed.

Red Hat rates the impact of this flaw as Important. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).

Weakness: CWE-59.

Affected products named by the advisory: external secrets operator for Red Hat OpenShift 1.2; Red Hat Hardened Images; Assisted Installer for Red Hat OpenShift Container Platform 2; Builds for Red Hat OpenShift; and 38 more.

Affected products named by the advisory: Compliance Operator; Confidential Compute Attestation; Custom Metric Autoscaler operator for Red Hat Openshift; DPU kit for NVIDIA; and 34 more.