CVE-2025-46835

What it actually does

Path traversal flaw in Git GUI that allows creation and overwrite of arbitrary files (for which the user has write permission) outside the repository root when a user clones an untrusted repository and interacts with a file inside a maliciously named directory.

Why it matters to the business

Attackers can silently modify or destroy user-writable files on developer workstations, resulting in data loss, configuration tampering, or supply-chain compromise that disrupts development workflows and requires incident response.

How an attack unfolds

An attacker publishes a repository containing a directory whose name is crafted to exploit path traversal. The victim clones the repository using Git GUI and is socially engineered into editing a file inside that directory; the GUI then follows the malicious path and writes attacker-controlled content to arbitrary locations on disk.

How to fix it

Upgrade Git to one of the fixed releases: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, or 2.50.1. Organizations using packaged distributions should apply the corresponding patched package versions that incorporate these Git fixes.

How to confirm the fix worked

Verify the installed Git version meets or exceeds a fixed release, attempt to reproduce the issue with a test repository containing a malicious directory name, and confirm that file writes remain confined to the repository working tree.

Typical attack path

1. Attacker creates a repository with a directory name containing path traversal sequences
2. Victim is tricked into cloning the repository with Git GUI
3. Victim opens or edits a file located inside the malicious directory
4. Git GUI resolves the crafted path and creates or overwrites files outside the repository
5. Attacker-chosen content is written to locations the user can write to

How to detect it

Review file-system audit logs and process execution history for Git GUI processes writing to paths outside recently cloned repository directories; correlate with repository clone timestamps and look for unexpected file creations or modifications shortly after GUI interaction.

What your security team should do

• Immediately upgrade all Git installations to a fixed version listed above
• Disable or restrict Git GUI usage for untrusted repositories until patches are deployed
• Add repository-clone and file-edit events to endpoint monitoring to detect anomalous file writes
• Communicate the upgrade requirement to all developers with a short deadline