{"id":"CVE-2026-114466","kind":"vulnerability","aliases":["CVE-2026-114466"],"related":[],"title":"Git: fast-import and fast-export can read or write arbitrary files","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe","summary":"Git's fast-import and fast-export tools have features that are not marked unsafe, so they can read or write arbitrary data. An attacker who can supply input to these tools could reach files outside the intended repository.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:36+00:00","triaged_at":"2026-11-12T14:39:08+00:00","updated_at":"2026-11-12T14:39:08+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-12T14:39:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Git: fast-import and fast-export can read or write arbitrary files","impact":"medium","summary":"Git's fast-import and fast-export tools have features that are not marked unsafe, so they can read or write arbitrary data. An attacker who can supply input to these tools could reach files outside the intended repository.","audience":"developers","category":"other","nicknames":[],"who_cares":["git"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"arbitrary files read or written through git import and export features","analyst_note":"Check the NVD entry and the Git project's security announcement for affected versions, fixed versions and whether the features need unsafe mode.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":4496,"output_tokens":342,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114466':17A,20A '-2026':16A,19A '1':75C,81C 'arbitrari':13A,45B,63C 'attack':48B 'could':56B 'cve':15A,18A 'data':46B,64C 'export':8A,30B,80C 'fast':3A,7A,25B,29B,73C,79C 'fast-export':6A,28B 'fast-import':2A,24B 'featur':33B,82C 'file':14A,58B 'git':1A,21B,22B,72C,78C 'git-fast-export':77C 'git-fast-import':71C 'import':4A,26B,74C 'input':52B 'intend':61B 'mark':37B,84C 'outsid':59B 'reach':57B 'read':10A,42B,67C 'repositori':62B 'suppli':51B 'tool':31B,55B 'unsaf':38B,85C 'write':12A,44B 'written':69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["git","medium","other"],"campaign_type":null,"search_a":"'-114466':17A,20A '-2026':16A,19A 'arbitrari':13A 'cve':15A,18A 'export':8A 'fast':3A,7A 'fast-export':6A 'fast-import':2A 'file':14A 'git':1A 'import':4A 'read':10A 'write':12A","search_b":"'arbitrari':45B 'attack':48B 'could':56B 'data':46B 'export':30B 'fast':25B,29B 'fast-export':28B 'fast-import':24B 'featur':33B 'file':58B 'git':21B,22B 'import':26B 'input':52B 'intend':61B 'mark':37B 'outsid':59B 'reach':57B 'read':42B 'repositori':62B 'suppli':51B 'tool':31B,55B 'unsaf':38B 'write':44B","search_c":"'1':75C,81C 'arbitrari':63C 'data':64C 'export':80C 'fast':73C,79C 'featur':82C 'git':72C,78C 'git-fast-export':77C 'git-fast-import':71C 'import':74C 'mark':84C 'read':67C 'unsaf':85C 'written':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","severity":null,"published_at":"2026-11-12T14:17:23+00:00","modified_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:36+00:00","fetched_at":"2026-11-12T14:38:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}