Git LFS Vulnerability in Multiple Versions Exposing File System Risks
CVE-2025-26625

8.6HIGH

Key Information:

Vendor

Git-lfs

Status
Git-lfs
Vendor
CVE Published:
17 October 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-26625?

A vulnerability in Git LFS exists where certain commands, such as 'git lfs checkout' and 'git lfs pull,' can write to files outside of the intended Git working tree. This occurs when symbolic or hard links are present that collide with paths used by Git LFS. This allows an attacker to create a specially crafted repository that can write to arbitrary locations on the filesystem accessible to the user executing these commands. Additionally, in bare repositories, similar commands may result in unauthorized file writes beyond the repository boundaries. This issue has been addressed in Git LFS version 3.7.1, which mitigates this risk.

Affected Version(s)

git-lfs >= 0.5.2, < 3.7.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE_2025_26625
Created by Mitchellzhou1

References

https://github.com/git-lfs/git-lfs/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/git-lfs/git-lfs/commit/0cffe93176b8700...
x_refsource_MISC
https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095...
x_refsource_MISC

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-26625 : Git LFS Vulnerability in Multiple Versions Exposing File System Risks