CVE-2026-71556: go-git: Worktree operations may follow symlinks

A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path.

The worktreeFilesystem wrapper rejected dangerous path strings, including paths containing .git, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.

As a result, a path that is safe when evaluated as a string could still resolve into the repository’s Git metadata directory. For example, if s is a symbolic link to .git, writing to s/config would modify .git/config.

A symbolic link at the final path component could also be followed. For example, if s points directly to .git/config, opening s for writing with truncation could overwrite the repository configuration.

Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.

Applications using storage/memory for their Storer, or go-billy/memfs for their Worktree, are not affected by this vulnerability.