go‑git is a pure‑Go implementation of Git. Prior to releases 5.19.2 and 6.0.0‑alpha.5, reference names supplied by a caller are not validated before they are combined to form on‑disk paths under the reference storage directory. A specially crafted reference name that contains directory‑traversal segments can therefore cause the library to write arbitrary files outside that directory, potentially overwriting or creating sensitive files. The vulnerability is a path traversal flaw (CWE‑22).

The affected product is go‑git (go‑git/go‑git). All releases before 5.19.2 and before 6.0.0‑alpha.5 are vulnerable.

The CVSS score of 6.3 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker supplying a malicious reference name—such as when cloning or pulling from an untrusted repository—potentially allowing the flaw to be exploited to write files outside the repository’s reference directory, leading to local file corruption or potential privilege escalation if the process runs with elevated rights. The attack requires the victim to run go‑git to process the attacker‑controlled reference, which is feasible in many application environments that embed the library.