Vulnerability · Published Jul 10, 2025 · Assigned by GitHub_M
CVE-2025-46835Git GUI can create and overwrite files for which the user has write permission
High 8.5
In plain English
A high-severity argument injection in git-gui from j6t. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.6%top 50.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | git | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-all | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-all | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-all | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:8 | git-core | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-core | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-core-doc | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-core-doc | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-core-doc | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:8 | git-credential-libsecret | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-credential-libsecret | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:8 | git-daemon | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-daemon | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-email | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-email | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-email | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-gui | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-gui | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-gui | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-instaweb | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-instaweb | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-instaweb | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-subtree | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-subtree | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-subtree | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-svn | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-svn | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-svn | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | gitk | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | gitk | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | gitk | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | gitweb | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | gitweb | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | gitweb | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | perl-Git | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | perl-Git | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | perl-Git | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | perl-Git-SVN | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | perl-Git-SVN | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | perl-Git-SVN | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| Alpine:v3.20 | git | 2.45.4-r0 | ALPINE-CVE-2025-46835 |
| Alpine:v3.21 | git | 2.47.3-r0 | ALPINE-CVE-2025-46835 |
| Alpine:v3.22 | git | 2.49.1-r0 | ALPINE-CVE-2025-46835 |
| Alpine:v3.23 | git | 2.50.1-r0 | ALPINE-CVE-2025-46835 |
| Alpine:v3.24 | git | 2.50.1-r0 | ALPINE-CVE-2025-46835 |
| Debian:12 | git | 1:2.39.5-0+deb12u3 | DEBIAN-CVE-2025-46835 |
| Debian:13 | git | 1:2.47.3-0+deb13u1 | DEBIAN-CVE-2025-46835 |
| Debian:14 | git | 1:2.50.1-0.1 | DEBIAN-CVE-2025-46835 |
| Rocky Linux:8 | git | 0:2.43.7-1.el8_10 | RLSA-2025:11534 |
| Rocky Linux:9 | git | 0:2.47.3-1.el9_6 | RLSA-2025:11462 |
| Ubuntu:22.04:LTS | git | 1:2.34.1-1ubuntu1.13 | USN-7626-1 |
| Ubuntu:22.04:LTS | git | 1:2.34.1-1ubuntu1.15 | UBUNTU-CVE-2025-46835 |
| Ubuntu:24.04:LTS | git | 1:2.43.0-1ubuntu7.3 | UBUNTU-CVE-2025-46835 |
| Ubuntu:24.04:LTS | git | 1:2.43.0-1ubuntu7.3 | USN-7626-1 |
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
References
- https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg x_refsource_CONFIRM
- https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html
- http://www.openwall.com/lists/oss-security/2025/07/08/4