CVE-2025-48384
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- EPSS probability
- 4.11%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-436, CWE-59
- Published
- 2025-07-08
- Last modified
- 2026-02-26
Affected products
- git git
- git git
- git git
- git git
- git git
- git git
- git git
- git git
Weakness type
Related vulnerabilities
- CVE-2023-24813 — URI validation failure on SVG parsing. Bypass of CVE-2023-23924
- CVE-2025-25291 — ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
- CVE-2025-25292 — Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
- CVE-2022-36051 — Broken Authorization in ZITADEL Actions
- CVE-2023-36456 — Authentik lacks Proxy IP headers validation
- CVE-2022-35962 — Crafted link in Zulip message can cause disclosure of credentials
- CVE-2026-87627 — Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leve
- CVE-2026-57580 — authentik: Account Takeover via SAML NameID Comment Truncation