CVE-2025-46835

A vulnerability was found in the git GUI package. When a user clones an untrusted repository and edits a file located in a maliciously named directory, git GUI may end up creating or overwriting arbitrary files for the running user has written permission. This flaw allows an attacker to modify the content of target files without the affected user's intent, resulting in a data integrity issue.

Red Hat Product Security team has rated this vulnerability as having a Low severity. The is due to the high complexity in exploiting the vulnerability. Additionally, the user needs to be tricked into cloning an untrusted repository and editing a file located in a directory with a maliciously crafted name.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using Git GUI (the "git gui" command) to inspect or modify files in repositories cloned from untrusted sources; use the Git command-line interface or another trusted tool instead. Updating to a version of git with the fixed git-gui, as made available through Red Hat product updates, resolves this issue.