{"id":"CVE-2026-113408","kind":"vulnerability","aliases":["CVE-2026-113408"],"related":[],"title":"Git: crafted repository can write files outside the clone location","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository","summary":"A path traversal flaw in Git lets a malicious repository make a clone or commit write to an arbitrary file on disk. An attacker who gets a user to clone and commit to a bad repository can overwrite files the user can reach.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developers","git","other"],"not_affected_if":["only-trusted-repositories"],"how_to_check":"- Run `git --version` and compare against the fixed release listed by the vendor (unknown from sources).","fix":null,"status":"open","published_at":"2026-11-12T07:16:45+00:00","first_seen_at":"2026-11-12T07:37:03+00:00","triaged_at":"2026-11-12T07:38:08+00:00","updated_at":"2026-11-12T07:38:08+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-12T07:38:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Git: crafted repository can write files outside the clone location","impact":"medium","summary":"A path traversal flaw in Git lets a malicious repository make a clone or commit write to an arbitrary file on disk. An attacker who gets a user to clone and commit to a bad repository can overwrite files the user can reach.","audience":"developers","category":"other","nicknames":[],"who_cares":["git","developers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"arbitrary file overwrite on the user's machine","analyst_note":"Confirm affected Git versions and fixed release from the NVD entry or Git's security announcements; check whether clone alone or commit is required.","how_to_check":"- Run `git --version` and compare against the fixed release listed by the vendor (unknown from sources).\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["only-trusted-repositories"],"who_is_affected":"Anyone running Git to clone and commit to repositories from untrusted sources. The sources give no affected version range and do not say which Git operations are required, so exposure is unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000669,"input_tokens":4477,"output_tokens":443,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-113408':13A,16A '-2026':12A,15A 'allow':66C 'arbitrari':37B,69C 'attack':42B 'bad':53B,76C 'clone':9A,31B,48B,72C 'commit':33B,50B,74C 'craft':2A 'cve':11A,14A 'develop':17B 'disk':40B 'file':6A,38B,57B,70C 'flaw':22B 'get':44B 'git':1A,18B,24B,65C 'let':25B 'locat':10A 'make':29B 'malici':27B 'outsid':7A 'overwrit':56B 'path':20B,62C 'reach':61B 'repositori':3A,28B,54B,77C 'travers':21B,63C 'user':46B,59B 'via':71C 'write':5A,34B,67C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Git to clone and commit to repositories from untrusted sources. The sources give no affected version range and do not say which Git operations are required, so exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developers","git","low","other"],"campaign_type":null,"search_a":"'-113408':13A,16A '-2026':12A,15A 'clone':9A 'craft':2A 'cve':11A,14A 'file':6A 'git':1A 'locat':10A 'outsid':7A 'repositori':3A 'write':5A","search_b":"'arbitrari':37B 'attack':42B 'bad':53B 'clone':31B,48B 'commit':33B,50B 'develop':17B 'disk':40B 'file':38B,57B 'flaw':22B 'get':44B 'git':18B,24B 'let':25B 'make':29B 'malici':27B 'overwrit':56B 'path':20B 'reach':61B 'repositori':28B,54B 'travers':21B 'user':46B,59B 'write':34B","search_c":"'allow':66C 'arbitrari':69C 'bad':76C 'clone':72C 'commit':74C 'file':70C 'git':65C 'path':62C 'repositori':77C 'travers':63C 'via':71C 'write':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T07:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","severity":null,"published_at":"2026-11-12T07:16:45+00:00","modified_at":"2026-11-12T07:16:45+00:00","first_seen_at":"2026-11-12T07:37:03+00:00","fetched_at":"2026-11-12T07:37:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}