Git Link Following Vulnerability (CVE-2025-48384)

Historical catalog analysis: CISA added this entry on August 25, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-48384 is a link following vulnerability identified in Git. The root cause of this exposure is the inconsistent manner in which Git handles carriage return characters within configuration files. This flaw is categorized under CWE-59 and CWE-436, relating to how the software manages symbolic links and file paths.

Exposure and applicability

This vulnerability affects Git installations across various environments due to its nature as a widely deployed open-source component. Because it resides in a core tool used for version control and automation, exposure is broad. Specifically, organizations utilizing the following platforms should evaluate their current deployments against vendor-specific advisories:
* Red Hat Enterprise Linux
* AWS Amazon Linux 2 (AL2)
* Oracle Linux
* Microsoft Windows environments
* Generic Git installations sourced directly from the Git project/GitHub

Remediation priorities

Our analysis suggests that remediation should be prioritized based on the presence of Git in automated pipelines, build servers, and developer workstations where untrusted configuration files might be processed.

Corrective actions are supported by vendor-specific patches. Defenders should prioritize updates according to the following hierarchy:
1. Critical Infrastructure/Build Servers: Immediate application of patches from Red Hat, AWS, Oracle, or Microsoft to prevent potential exploitation in high-privilege environments.
2. Developer Workstations: Deployment of updated Git versions to reduce the local attack surface.
3. Cloud Services: Review and application of mitigations as outlined in BOD 22-01 guidance for applicable cloud service providers.

How to validate remediation

To verify that exposure has been reduced, vulnerability management teams should move beyond simple version checks. While updating the binary is the primary corrective action, validation should include:
* Vendor Confirmation: Cross-referencing the installed package version against the specific fixed versions listed in the Red Hat, AWS, Oracle, or Microsoft security advisories.
* Configuration Audit: Ensuring that Git configuration files are managed through secure channels to prevent the introduction of malicious carriage return characters.

Verification is complete when the deployed version matches or exceeds the vendor’s patched release and the asset is confirmed as updated in the centralized inventory.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, while patches are available from major vendors, the specific conditions required to trigger the link following behavior—such as the exact structure of the malicious configuration file—are not detailed in the primary advisory.

Residual risk persists if organizations use custom-compiled versions of Git that do not incorporate the latest security fixes from the upstream project. Additionally, patching the binary does not retroactively clean existing configuration files that may have been tampered with prior to the update.

Source and editorial note

CVE-2025-48384: Git Link Following Vulnerability · Source date: August 25, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: August 28, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 04, 2026 at 00:53 UTC.

Request a Vulnerability Assessment