# CVE-2026-114466: Git arbitrary data read/write via fast-import and fast-export

Source: https://junglewise.ai/threats/cve-2026-114466-arbitrary-data-can-be-read-or-written-through-git-fast-import-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-114466 · Severity: medium · CVSS 4.4 · Published 2026-11-12

Git's fast-import and fast-export commands contain features that allow arbitrary files to be read from or written to a system when processing untrusted repository data. An attacker who tricks a user into importing or exporting a malicious repository could access sensitive files or modify system data. This is a follow-up to an earlier similar vulnerability (CVE-2019-1348) and affects newly introduced features that had not been properly restricted.

Technologies: [Git](https://junglewise.ai/threats/technologies/git). Vendors: [Git](https://junglewise.ai/threats/vendors/git).

## Quick answers

**Is CVE-2026-114466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114466 being exploited in the wild.

**How severe is CVE-2026-114466?** Medium severity, with a CVSS score of 4.4, published 12 November 2026.

**Which products and versions are affected?** Git Git.

**Is there a fix for CVE-2026-114466?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114466 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114466?** Check whether you run Git. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in git-fast-import(1) and git-fast-export(1) commands, where the features `rewrite-submodules-to`, `rewrite-submodules-from`, and the option `export-pack-edges` allow reading from or writing to arbitrary filesystem paths. These features were not marked as unsafe despite being introduced after a prior disclosure (CVE-2019-1348) that addressed the same class of issue with the `export-marks` feature. The attack requires processing untrusted repository data, but the precise preconditions and exploit chain are not detailed in the advisory.

## Affected products

- Git Git

## Timeline

- 2026-11-12: disclosed

## References

- [https://gitlab.com/gitlab-org/git/-/work_items/812](https://gitlab.com/gitlab-org/git/-/work_items/812)

## Related threats

- [Git heap buffer overflow in three-way merge code](https://junglewise.ai/threats/cve-2026-105437-affected-versions-of-git-have-a-heap-buffer-overflow-in-the)
- [Git link following vulnerability in submodule handling](https://junglewise.ai/threats/cve-2025-48384-git-link-following-vulnerability-in-submodule-handling)