Read the docs
TI-2025-30710 Aliases CVE-2025-48385

Git alllows arbitrary file writes via bundle-uri parameter injection

Priority MEDIUM 41CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 18 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-88.

Summary

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0106 64th percentileScored 2026-11-07
Fix Partial git (git): 2.43.7, 2.44.4, 2.45.4 +5Red Hat: 16 advisoriesRed Hat: 18 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gitgitbefore 2.43.7; 2.44.0-rc0 to before 2.44.4; 2.45.0-rc0 to before 2.45.4; 2.46.0-rc0 to before 2.46.4; 2.47.0-rc0 to before 2.47.3; 2.48.0-rc0 to before 2.48.2; 2.49.0-rc0 to before 2.49.1; 2.50.0-rc0 to before 2.50.12.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1Patch availableCNA
  • git VendorGit Affected before 2.43.7; 2.44.0-rc0 to before 2.44.4; 2.45.0-rc0 to before 2.45.4; 2.46.0-rc0 to before 2.46.4; 2.47.0-rc0 to before 2.47.3; 2.48.0-rc0 to before 2.48.2; 2.49.0-rc0 to before 2.49.1; 2.50.0-rc0 to before 2.50.1 Fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1 Patch available CNA

Remediation

  • Fix · CNA git (git) Fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1

Red Hat 16 advisories

  • RHSA-2025:15672 Released 2025-09-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202509030117-0
  • RHSA-2025:15847 Released 2025-09-15 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.23.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/machineexec-rhel9 +3
  • RHSA-2025:15828 Released 2025-09-15 · Red Hat rating Important
    updated web-terminal/tooling container image
    • Red Hat Web Terminal 1.11 on RHEL 9 web-terminal/web-terminal-rhel9-operator, web-terminal/web-terminal-tooling-rhel9
Show 13 more Red Hat advisories
  • RHSA-2025:15827 Released 2025-09-15 · Red Hat rating Important
    updated web-terminal/tooling container image
    • Red Hat Web Terminal 1.12 on RHEL 9 web-terminal/web-terminal-tooling-rhel9
  • RHSA-2025:14858 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.16.47 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202508261955-0, rhcos-ppc64le-416.94.202508261955-0, rhcos-s390x-416.94.202508261955-0 +1
  • RHSA-2025:14853 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.14.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202508270040-0, rhcos-ppc64le-414.92.202508270040-0, rhcos-s390x-414.92.202508270040-0 +1
  • RHSA-2025:14396 Released 2025-08-27 · Red Hat rating Important
    OpenShift Container Platform 4.15.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202508192014-0, rhcos-ppc64le-415.92.202508192014-0, rhcos-s390x-415.92.202508192014-0 +1
  • RHSA-2025:14059 Released 2025-08-27 · Red Hat rating Important
    OpenShift Container Platform 4.17.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202508141510-0, rhcos-ppc64le-417.94.202508141510-0, rhcos-s390x-417.94.202508141510-0 +1
  • RHSA-2025:13933 Released 2025-08-20 · Red Hat rating Important
    OpenShift Container Platform 4.19.9 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202508112354-0, rhcos-ppc64le-4.19.9.6.202508112354-0, rhcos-s390x-4.19.9.6.202508112354-0 +1
  • RHSA-2025:13276 Released 2025-08-07 · Red Hat rating Important
    updated RHEL-8 based Middleware Containers container images
    • Middleware Containers for OpenShift rhpam-7/rhpam-businesscentral-monitoring-rhel8, rhpam-7/rhpam-businesscentral-rhel8, rhpam-7/rhpam-controller-rhel8 +6
  • RHSA-2025:11794 Released 2025-07-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) git-2.39.5-1.el8_8.2, git-all-2.39.5-1.el8_8.2, git-core-2.39.5-1.el8_8.2 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) git-2.39.5-1.el8_8.2, git-all-2.39.5-1.el8_8.2, git-core-2.39.5-1.el8_8.2 +12
  • RHSA-2025:11795 Released 2025-07-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) git-2.39.5-1.el9_2.2, git-all-2.39.5-1.el9_2.2, git-core-2.39.5-1.el9_2.2 +12
  • RHSA-2025:11686 Released 2025-07-24 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) git-2.43.5-1.el9_4.2, git-all-2.43.5-1.el9_4.2, git-core-2.43.5-1.el9_4.2 +12
  • RHSA-2025:11534 Released 2025-07-23 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-2.43.7-1.el8_10, git-all-2.43.7-1.el8_10, git-core-2.43.7-1.el8_10 +12
  • RHSA-2025:11533 Released 2025-07-22 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 10) git-2.47.3-1.el10_0, git-all-2.47.3-1.el10_0, git-core-2.47.3-1.el10_0 +12
  • RHSA-2025:11462 Released 2025-07-21 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-2.47.3-1.el9_6, git-all-2.47.3-1.el9_6, git-core-2.47.3-1.el9_6 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Middleware Containers for OpenShiftFixed RHSA-2025:13276
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:11533
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:11534
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:11462
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:11794
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:11795
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:11686
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:11794
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:15672
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:14853
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:14396
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:14858
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:14059
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:13325
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:13933
Red Hat OpenShift Dev Spaces (RHOSDS) 3.23Fixed RHSA-2025:15847
Red Hat Web Terminal 1.11 on RHEL 9Fixed RHSA-2025:15828
Red Hat Web Terminal 1.12 on RHEL 9Fixed RHSA-2025:15827
Not affected: 4 products
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48385

References

Other 1

  • TI-2025-30709 Git allows arbitrary code execution through broken config quoting KEVCVSS 3.1HIGH 8.1
  • TI-2022-07580 gitattributes parsing integer overflow in git CVSS 3.1CRITICAL 9.8
  • TI-2022-20244 Integer overflow in `git archive`, `git log --format` leading to RCE in git CVSS 3.1CRITICAL 9.8
  • TI-2021-04400 malicious repositories can execute remote code while cloning CVSS 3.1HIGH 8.0
  • TI-2024-21101 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVSS 3.1CRITICAL 9.1
  • TI-2023-10933 "git apply --reject" partially-controlled arbitrary file write CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences