CVE-2025-27613

published 2025-07-10

CVE-2025-27613: Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments…

Priority P4 14 low 3.6 CVSS 3.1

AV L AC L PR N UI R S C C N I L A N

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Affected

32 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	git	< git 1:2.39.5-0+deb12u3 (bookworm)	git 1:2.39.5-0+deb12u3 (bookworm)
git	git	>= 0 < 1:2.30.2-1+deb11u5	1:2.30.2-1+deb11u5
git	git	>= 0 < 1:2.39.5-0+deb12u3	1:2.39.5-0+deb12u3
git	git	>= 0 < 1:2.47.3-0+deb13u1	1:2.47.3-0+deb13u1
git	git	>= 0 < 1:2.50.1-0.1	1:2.50.1-0.1
git	git	>= 0 < 1:2.34.1-1ubuntu1.14	1:2.34.1-1ubuntu1.14
git	git	>= 0 < 1:2.34.1-1ubuntu1.15	1:2.34.1-1ubuntu1.15
git	git	>= 0 < 1:2.34.1-1ubuntu1.13	1:2.34.1-1ubuntu1.13
git	git	>= 0 < 1:2.43.0-1ubuntu7.3	1:2.43.0-1ubuntu7.3
git	git	>= 0 < 1:2.7.4-0ubuntu1.10+esm10	1:2.7.4-0ubuntu1.10+esm10
git	git	>= 0 < 1:2.7.4-0ubuntu1.10+esm11	1:2.7.4-0ubuntu1.10+esm11
git	git	>= 0 < 1:2.7.4-0ubuntu1.10+esm9	1:2.7.4-0ubuntu1.10+esm9
git	git	>= 0 < 1:2.17.1-1ubuntu0.18+esm3	1:2.17.1-1ubuntu0.18+esm3
git	git	>= 0 < 1:2.17.1-1ubuntu0.18+esm4	1:2.17.1-1ubuntu0.18+esm4
git	git	>= 0 < 1:2.17.1-1ubuntu0.18+esm2	1:2.17.1-1ubuntu0.18+esm2
git	git	>= 0 < 1:2.25.1-1ubuntu3.14+esm2	1:2.25.1-1ubuntu3.14+esm2
git	git	>= 0 < 1:2.25.1-1ubuntu3.14+esm3	1:2.25.1-1ubuntu3.14+esm3
git	git	>= 0 < 1:2.25.1-1ubuntu3.14+esm1	1:2.25.1-1ubuntu3.14+esm1
j6t	gitk	—	—
j6t	gitk	—	—
j6t	gitk	—	—
j6t	gitk	—	—
j6t	gitk	—	—
j6t	gitk	—	—
j6t	gitk	—	—

CVSS provenance

nvd v3.1 3.6 LOW CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

osv 3.6 LOW

vendor_debian 3.6 LOW

vendor_msrc 3.6 LOW

vendor_redhat 3.6 LOW

vendor_ubuntu 3.6 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78 CWE-73