PT-2025-42616 · Github+8 · Git Lfs+8
Published
2025-10-06
·
Updated
2026-05-31
·
CVE-2025-26625
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Git LFS versions 0.5.2 through 3.7.0
Description
Git LFS commands, specifically
git lfs checkout and git lfs pull, may write to files outside the intended Git working tree if symbolic or hard links are present that conflict with paths tracked by Git LFS. This occurs because these commands do not initially check for symbolic links before writing files. This issue also affected bare repositories, allowing writes to files outside the repository. The issue is addressed by revising the git lfs checkout and git lfs pull commands to check for symbolic links and remove existing files before writing new ones.Recommendations
Update to Git LFS version 3.7.1 or later.
As a workaround, disable symlink support in Git by setting the
core.symlinks configuration option to false. However, note that existing symbolic or hard links in repositories may still allow Git LFS to write to their targets.Exploit
Fix
DoS
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Git Lfs
Linuxmint
Red Hat
Red Os
Rocky Linux
Ubuntu