#VU109655 Input validation error in GitHub Desktop - CVE-2025-48064
Published: May 22, 2025
GitHub Desktop
Git
Description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input. When viewing a file diff in the history view GitHub Desktop will call git log or git diff with the object id (SHA) of the commit, the name of the file, and the old name of the file if the file has been renamed. s a security precaution Git will attempt to fully resolve the old and new path via realpath,
traversing symlinks, to ensure that the resolved paths reside within
the repository working directory. This can lead to Git attempting to
access a path that resides on a network share (UNC path) and in doing so
Windows will attempt to perform NTLM authentication which passes
information such as the computer name, the currently signed in (Windows)
user name, and an NTLM hash. An attacker convincing a user to view a file in a commit of their making
in the history view can cause information disclosure by means of Git
attempting to access a network share.