---
id: "CVE-2025-48384"
kind: "vulnerability"
aliases: ["CVE-2025-48384"]
title: "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both\u2026"
severity: "high"
cvss: 8.0
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Git Git", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.43.7"], "affected": "< 2.43.7", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.44.4"], "affected": ">= 2.44.0, < 2.44.4", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.45.4"], "affected": ">= 2.45.0, < 2.45.4", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.46.4"], "affected": ">= 2.46.0, < 2.46.4", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.47.3"], "affected": ">= 2.47.0, < 2.47.3", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.48.2"], "affected": ">= 2.48.0, < 2.48.2", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.49.1"], "affected": ">= 2.49.0, < 2.49.1", "ecosystem": "vendor"}, {"name": "git-scm git", "fixed": ["2.50.1"], "affected": ">= 2.50.0, < 2.50.1", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "apple xcode", "fixed": ["26.0"], "affected": "< 26.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ci-runners", "developers", "exploited", "git", "runtime", "self-hosted"]
not_affected_if: ["git-not-installed"]
published_at: "2025-07-08T19:15:42+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48384", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48384", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both…

Git mishandles carriage return characters in configuration files, which lets a crafted repository or config cause Git to follow a symbolic link to a path it should not touch. An attacker who can get a victim to use a malicious repository could read or write files outside the intended location on the victim's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Git Git affected ? fixed ?
- vendor:git-scm git affected < 2.43.7 fixed 2.43.7
- vendor:git-scm git affected >= 2.44.0, < 2.44.4 fixed 2.44.4
- vendor:git-scm git affected >= 2.45.0, < 2.45.4 fixed 2.45.4
- vendor:git-scm git affected >= 2.46.0, < 2.46.4 fixed 2.46.4
- vendor:git-scm git affected >= 2.47.0, < 2.47.3 fixed 2.47.3
- vendor:git-scm git affected >= 2.48.0, < 2.48.2 fixed 2.48.2
- vendor:git-scm git affected >= 2.49.0, < 2.49.1 fixed 2.49.1
- vendor:git-scm git affected >= 2.50.0, < 2.50.1 fixed 2.50.1
- vendor:debian linux affected = 11.0 fixed ?
- vendor:apple xcode affected < 26.0 fixed 26.0

## How to check

Run 'git --version' and compare against the fixed release in the vendor advisory.
Check whether the version reports an unpatched build from your OS package manager.

## Fix

Upgrade Git to a patched release per the vendor advisory (fixed version not stated in the source).
If upgrade is not possible, follow CISA mitigation guidance: apply vendor mitigations or discontinue use.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48384
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-48384

## From the sources

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_