PT-2025-45838 · Go · Github.Com/Git-Lfs/Git-Lfs+1

Published 2025-10-30 · Updated 2025-10-30

OSV

Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs

Related Identifiers

GO-2025-4038

Affected Products

Github.Com/Git-Lfs/Git-Lfs

Github.Com/Git-Lfs/Git-Lfs/V3

References · 6

• https://osv.dev/vulnerability/GO-2025-4038 · Vendor Advisory
• https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8 · Note
• https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1 · Note
• https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5 · Note
• https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396 · Note
• https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615 · Note