CVE-2023-49569criticalCWE-22

CVE-2023-49569: critical vulnerability in go-git

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

Published · Updated

Follow this CVE+ Monitor go-git+ Monitor golang-github-go-git-go-git

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.5%
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
go-git · go-git
Related CVEs — go-git

In the same product, most dangerous first.

CVE-2025-21613CRITICALgo-git has an Argument Injection via the URL fieldEPSS 1.3%CVE-2025-21614HIGHgo-git clients vulnerable to DoS via maliciously crafted Git server repliesEPSS 0.7%CVE-2023-49568HIGHMaliciously crafted Git server replies can cause DoS on go-git clientsEPSS 0.7%CVE-2026-71557MEDIUMgo-git: Malicious reference names may modify files outside the reference storageEPSS 0.4%CVE-2026-45570LOWgo-git: Improper single-quote escaping in go-git SSH transportEPSS 0.4%CVE-2026-71556HIGHgo-git: Worktree operations may follow symlinksEPSS 0.4%