---
id: "CVE-2026-114466"
page: "https://infrastack.ai/live/CVE-2026-114466"
kind: "vulnerability"
aliases: ["CVE-2026-114466"]
title: "Git: fast-import and fast-export can read or write arbitrary files"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["git", "other"]
not_affected_if: []
published_at: "2026-11-12T14:17:23+00:00"
first_seen_at: "2026-11-12T14:38:36+00:00"
updated_at: "2026-11-12T14:39:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114466", "first_seen_at": "2026-11-12T14:38:36+00:00"}]
exploit_sources: []
---

# Git: fast-import and fast-export can read or write arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-114466 (this .md is for agents)

Git's fast-import and fast-export tools have features that are not marked unsafe, so they can read or write arbitrary data. An attacker who can supply input to these tools could reach files outside the intended repository.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-12T14:38:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114466

## From the sources

Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_