ZeroDay Findings
Sign inSign up

Findings

CVE-2025-48384

Git Link Following Vulnerability

Published Jul 8, 2025 · updated Sep 24, 2026 · git-scm git

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 8, 2025 · Catalog

    Detected

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializ

  2. Aug 25, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Sep 15, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Sep 24, 2026 · Catalog

    Updated

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializ

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Sep 15, 2025

Affected

  • cpe apple/xcodeversion unspecified
  • cpe debian/debian linux11.0
  • cpe git-scm/gitversion unspecified
  • vendor Git Gitversion unspecified

Sources

  • CISA KEVCVE-2025-48384

    Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.

    cisa.gov
  • CVE.orgCVE-2025-48384

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-48384

    30-day exploitation probability 4.4%

    first.org
  • NIST NVDCVE-2025-48384

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config

    nvd.nist.gov

References

CVE-2025-48384 · ZeroDay Findings