CVE-2025-46835

HIGH8.5

Git GUI can create and overwrite files for which the user has write permission

Published Jul 10, 2025

Modified 2 months ago

Details

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

References

WEBhttp://www.openwall.com/lists/oss-security/2025/07/08/4 WEBhttps://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da WEBhttps://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg WEBhttps://lists.debian.org/debian-lts-announce/2025/10/msg00003.html ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-46835

CVSS Analysis

CVSS v3.1

8.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

LowA:L

8.5/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Weakness Type (CWE)

Other

CWE-88

Ecosystems

Timeline

PublishedJul 10, 2025

ModifiedNov 4, 2025