This vulnerability in the go-git library allows worktree operations such as checkout, status, and add to resolve symbolic links that point outside the intended working directory. The flaw is a classic path traversal (CWE‑59) that can result in arbitrary reading or writing of files beyond the repository root, potentially exposing sensitive data or enabling modification of system files by an attacker who controls the repository. The impact is therefore a compromise of confidentiality and integrity for any process that uses the vulnerable library.

The issue affects the go‑git library before release version 5.19.2 and before the 6.0.0‑alpha.5 milestone. Any application or service that incorporates these earlier versions and performs worktree operations on a repository that contains malicious symlinks is vulnerable. Updating to 5.19.2 or later, or to 6.0.0‑alpha.5 or later, removes the flaw.

The CVSS score is 7.1, indicating a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the fact that the vulnerability is triggered when the library processes a repository containing a symlink; an attacker must supply a crafted repository to the application. Once the library is invoked on a malicious repository, the symlink resolution bypass can lead to reading or writing any file the process can access. The mitigation is to patch the library.