Git LFS Vulnerability in Multiple Versions Exposing File System Risks

CVE-2025-26625

What is CVE-2025-26625?

A vulnerability in Git LFS exists where certain commands, such as 'git lfs checkout' and 'git lfs pull,' can write to files outside of the intended Git working tree. This occurs when symbolic or hard links are present that collide with paths used by Git LFS. This allows an attacker to create a specially crafted repository that can write to arbitrary locations on the filesystem accessible to the user executing these commands. Additionally, in bare repositories, similar commands may result in unauthorized file writes beyond the repository boundaries. This issue has been addressed in Git LFS version 3.7.1, which mitigates this risk.

References