Git fast-import's rewrite-submodules-to and rewrite-submodules-from features and its export-pack-edges option were accepted from the input stream without --allow-unsafe-features, giving arbitrary file access. The rewrite-submodules features read an arbitrary file and leak its content in the "corrupt mark line" error message; export-pack-edges opens an arbitrary file in append mode and can write attacker-controlled data to it. Triggered by feeding an untrusted stream to git fast-import. Fixed in Git 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1 and 2.56.1, which gate these behind --allow-unsafe-features.