CVE-2026-71557-poc

CVE-2026-71557: PoC de path traversal en el nombre de referencia de go-git Versión en inglés Resumen Este repositorio es un PoC local seguro de CVE-2026-71557 , basado en el aviso público de go-git GHSA-qgq7-7hm3-q39j. La versión anterior de storage/filesystem no validaba suficientemente el nombr...

Security update for amazon-ssm-agent (important)

openSUSE security update: security update for amazon-ssm-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21884-1 Rating: important References: bsc1276981 bsc1276994 bsc1278681 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-71556...

gogs

gogs Aquí configuraremos nuestro laboratorio en nuestra máquina virtual SEED Ubuntu 16.04 y necesitamos instalar el Servicio Git de Go GOGS en nuestra máquina virtual antes de poder pasar a explotar la vulnerabilidad de inyección SQL. Para configurar la máquina virtual, estos son los pasos: Paso ...

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278681 CVE-2026-78662:...

CVE-2026-71557

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

CVE-2026-44881_exploit

CVE-2026-44881 — Portainer Git Symlink → Arbitrary Host File Read Single-script exploit for CVE-2026-44881 , a Git symlink injection in Portainer's stack-deployment flow that lets any low-privilege authenticated user with stack-creation rights read arbitrary files reachable by the Portainer...

SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:4082-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4082-1 advisory. - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. - CVE-2026-71557:...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

CLEANSTART-2026-NK57336 go-git is an extensible git implementation library written in pure Go

Multiple security vulnerabilities affect the grafana-alloy package. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

CVE-2026-92615 Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

CVE-2026-92615 Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

CVE-2026-92615

flightctl 's configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify , a custom CA bundle, or tenant-supplied mTLS client certificates ) and installs it into go-git's process-global client.Protocols map via gitclient...

SUSE-SU-2026:4210-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...