DLA-4323-1

CVE-2025-27613

With Gitk, the Git history browser, when a user clones an untrusted
repository and runs gitk without additional command arguments,
files for which the user has write permission can be created and
truncated. The option Support per-file encoding must have been enabled
before in Gitk's Preferences. This option is disabled by default. The
same happens when Show origin of this line is used in the main window
(regardless of whether Support per-file encoding is enabled or not).

CVE-2025-46835

When a user clones an untrusted repository and is tricked into editing
a file located in a maliciously named directory in the repository,
then Git GUI can create and overwrite files for which the user has
write permission.

CVE-2025-48384

When reading a config value, Git strips any trailing carriage return
and line feed (CRLF). When writing a config entry, values with a
trailing CR are not quoted, causing the CR to be lost when the config
is later read. When initializing a submodule, if the submodule path
contains a trailing CR, the altered path is read resulting in the
submodule being checked out to an incorrect location. If a symlink
exists that points the altered path to the submodule hooks directory,
and the submodule contains an executable post-checkout hook, the
script may be unintentionally executed after checkout.