ghtier
← Back to Enterprise plane incidents
EnterpriseFixed 2025

CVE-2025-3509: pre-receive hook RCE via port reuse

Pre-receive hook RCE via dynamically allocated ports available during operations such as hot-patch upgrades, requiring either site admin or a user able to modify repos with hooks already enabled.

Permissions abused

Site admin, or repo-hook-modify access, during a hot-patch window

Sources

Frameworks

CICD-SEC-7

Part of

Fixed. First seen April 2025. Mapping by ghtier, not yet reviewed. Threat landscape