It writes data to files, it may be used to do privileged writes or write files outside a restricted file system.
git log '--output=/tmp/foo'
HackerOne #658013 - Git flag injection - local file overwrite to remote code execution