CVE-2025-48384

8.0

HIGH CVSS 3.1

Git Link Following Vulnerability - [Actively Exploited]

Description

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

INFO

Published Date :

July 8, 2025, 7:15 p.m.

Last Modified :

Aug. 26, 2025, 2:45 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 15, 2025

Alert Date: Aug 25, 2025 | 25 days ago

Description :

Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ; https://access.redhat.com/errata/RHSA-2025:13933 ; https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html ; https://linux.oracle.com/errata/ELSA-2025-11534.html ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48384

Affected Products

The following products are affected by CVE-2025-48384 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Git	git
1	Git-scm	git

: Total Affected Vendor : 2 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

Update Git to a patched version to prevent submodule checkout issues and potential arbitrary code execution.

Update Git to a version that includes the fix.
Verify submodule checkout paths after updating.
Review Git configuration for unusual trailing characters.

Public PoC/Exploit Available at Github

CVE-2025-48384 has a 68 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-48384.

URL	Resource
https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-48384 is associated with the following CWEs:

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CWE-436: Interpretation Conflict

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-48384 weaknesses.

CAPEC-17: Using Malicious Files Using Malicious Files CAPEC-35: Leverage Executable Code in Non-Executable Files Leverage Executable Code in Non-Executable Files CAPEC-76: Manipulating Web Input to File System Calls Manipulating Web Input to File System Calls CAPEC-132: Symlink Attack Symlink Attack CAPEC-34: HTTP Response Splitting HTTP Response Splitting CAPEC-105: HTTP Request Splitting HTTP Request Splitting CAPEC-273: HTTP Response Smuggling HTTP Response Smuggling

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

s41r4j/CVE-2025-48384-submodule

CVE-2025-48384-submodule

Shell

Updated: 3 days ago

0 stars 0 fork 0 watcher

Born at : Sept. 13, 2025, 5:07 a.m. This repo has been linked 1 different CVEs too.

airkewld/cve-2025-48384-submodule

will delete later

Updated: 6 days, 12 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 12, 2025, 6:17 p.m. This repo has been linked 1 different CVEs too.

airkewld/cve-2025-48384

might delete later

Updated: 6 days, 12 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 12, 2025, 6:16 p.m. This repo has been linked 1 different CVEs too.

s41r4j/CVE-2025-48384

GIT vulnerability | Carriage Return and RCE on cloning

Shell

Updated: 3 days ago

0 stars 0 fork 0 watcher

Born at : Sept. 12, 2025, 8:41 a.m. This repo has been linked 1 different CVEs too.

8-cm/kube-dump

A powerful Kubernetes debugging tool that enables network capture, command execution, and file operations across multiple pods and nodes simultaneously through privileged debug pods.

Shell

Updated: 5 days, 21 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 11, 2025, 9:46 a.m. This repo has been linked 142 different CVEs too.

EdwardYeIntrix/CVE-2025-48384-Scanner

CVE-2025-48384 Scanner

Python

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Sept. 9, 2025, 4:57 a.m. This repo has been linked 1 different CVEs too.

arun1033/CVE-2025-48384

None

Shell

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 29, 2025, 11:48 a.m. This repo has been linked 1 different CVEs too.

butyraldehyde/CVE-2025-48384-PoC

Built to call on CVE-2025-48384-PoC-Part2 for RCE

Updated: 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Aug. 28, 2025, 6:54 p.m. This repo has been linked 1 different CVEs too.

butyraldehyde/CVE-2025-48384-PoC-Part2

RCE hook

Shell

Updated: 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Aug. 28, 2025, 5:43 p.m. This repo has been linked 1 different CVEs too.

jacobholtz/CVE-2025-48384-submodule

None

Shell

Updated: 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Aug. 28, 2025, 3:54 p.m. This repo has been linked 1 different CVEs too.

jacobholtz/CVE-2025-48384-poc

PoC for CVE-2025-48384

Updated: 2 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 28, 2025, 3:10 p.m. This repo has been linked 1 different CVEs too.

sahar042/CVE-2025-48384

None

Updated: 3 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Aug. 27, 2025, 7:45 a.m. This repo has been linked 1 different CVEs too.

wzx5002/totallynotsuspicious

sub for CVE-2025-48384

Shell

Updated: 3 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 27, 2025, 3:28 a.m. This repo has been linked 1 different CVEs too.

wzx5002/CVE-2025-48384

test

Updated: 3 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 27, 2025, 3:24 a.m. This repo has been linked 1 different CVEs too.

eliox01/CVE-2025-48384

PoC

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 25, 2025, 9:27 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-48384 vulnerability anywhere in the article.

The Hacker News

Apple Backports Fix for CVE-2025-43300 Exploited in Sophisticated Spyware Attack

Sep 16, 2025Ravie LakshmananVulnerability / Spyware Apple on Monday backported fixes for a recently patched security flaw that has been actively exploited in the wild. The vulnerability in question ...

Published Date: Sep 16, 2025 (2 days, 19 hours ago)

seclists.org

APPLE-SA-09-15-2025-12 Xcode 26

Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 15 Sep 2025 16:38:13 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ...

Published Date: Sep 16, 2025 (3 days, 3 hours ago)

Help Net Security

Week in review: 300k+ Plex Media Server instances still vulnerable to attack, exploited Git RCE flaw

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 300k+ Plex Media Server instances still vulnerable to attack via CVE-2025-34158 Over 300,000 internet- ...

Published Date: Aug 31, 2025 (2 weeks, 4 days ago)

CybersecurityNews

Citrix NetScaler ADC and Gateway 0-Day RCE Vulnerability Actively Exploited in Attacks

Cloud Software Group has disclosed multiple high-severity vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that can lead to remote code execution ...