{"id":"CVE-2026-112818","aliases":["DEBIAN-CVE-2026-112818","UBUNTU-CVE-2026-112818","openSUSE-SU-2026:12480-1"],"status":"published","title":"git-annex-10.20261026-1.1 on GA media","description":"[Unknown description]","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-27T05:47:29.742572557Z","modified":"2026-11-08T17:30:04Z","fixes":[{"ecosystem":"Debian:13","package":"git-annex","fixed_in":["10.20250416-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"git-annex","fixed_in":["10.20261026-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"git-annex","fixed_in":["10.20261026-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.20230126-3","10.20230407-1","10.20230407-2","10.20230626-1","10.20230802-1","10.20230802-1~bpo11+1","10.20230802-1~bpo12+1","10.20240129-1","10.20240129-1~bpo12+1","10.20240430-1","10.20240430-1~bpo12+1","10.20240927-1","10.20241031-1","10.20241202-1","10.20241202-1~bpo12+1","10.20241202-2","10.20250115-1","10.20250115-1~bpo12+1","10.20250416-1","10.20250416-1~bpo12+1","10.20250416-2","10.20250416-2~bpo12+1","10.20250721-1","10.20251029-1","10.20261006-1","10.20261026-1"]},{"source":"osv","ecosystem":"Debian:13","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.20250416-2+deb13u1"}]}],"versions":["10.20250416-2"]},{"source":"osv","ecosystem":"Debian:14","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.20261026-1"}]}],"versions":["10.20250416-2","10.20250721-1","10.20251029-1","10.20261006-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.20150731-1build1","5.20151208-1","5.20151208-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.20170818-1","6.20171124-1","6.20180112-1","6.20180112-2","6.20180227-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.20190912-1","7.20191017-1","7.20191024-1","7.20191114-1","7.20191230-1","7.20191230-1build4","7.20200219-1","8.20200226-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.20210223-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.20230626-1","10.20230802-1","10.20240129-1","10.20240129-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.20251029-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.20250721-1","10.20250721-1ubuntu1","10.20251029-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.20261026-1.1"}]}]}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-112818","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-112818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112818","tags":["report"]},{"url":"https://git-annex.branchable.com/security/cross_repository_data_exfiltration_via_special_remote/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-112818","tags":["web"]}],"sources":{"osv":[{"id":"DEBIAN-CVE-2026-112818","status":"published","published":"2026-10-27T05:47:29.742572557Z","modified":"2026-11-02T21:00:06.897264634Z","updated_at":"2026-11-03T00:03:07.015763Z"},{"id":"openSUSE-SU-2026:12480-1","title":"git-annex-10.20261026-1.1 on GA media","description":"These are all security issues fixed in the git-annex-10.20261026-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-07T00:00:00Z","modified":"2026-11-08T17:30:04.02270507Z","updated_at":"2026-11-08T17:37:58.502737Z"},{"id":"UBUNTU-CVE-2026-112818","description":"[Unknown description]","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-28T20:17:44.19340841Z","updated_at":"2026-11-02T16:55:59.591851Z"}]}}