CVE-2025-26625: Git LFS Arbitrary File Write Vulnerability
Summary
CVE-2025-26625: Git LFS may write to arbitrary files via crafted symlinks. Affects github.com/git-lfs/git-lfs versions >= 0.5.2, < 3.7.1. Fixed in 3.7.1. How to fix ↓
Also tracked for
- git-lfs · Bitnami
The same CVE-2025-26625 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS (Large File Storage) is an extension for Git that allows users to manage large files efficiently. It replaces large files in your repository with text pointers inside Git, while storing the file contents on a remote server. This functionality is crucial for developers working with large assets, such as media files, in their projects. However, Git LFS has a vulnerability that can lead to unintended file writes outside the intended working directory, posing a security risk.
Vulnerability Detail
The vulnerability arises when certain Git LFS commands, such as 'git lfs checkout' and 'git lfs pull', are executed. If symbolic or hard links exist that collide with the paths of files tracked by Git LFS, these commands may write to files that are outside the current Git working tree. This can lead to unauthorized access or modification of files, potentially compromising the integrity of the system. The issue has been present since version 0.5.2 and affects all subsequent versions up to 3.7.0.
How To Fix
Latest published version: v2.5.2+incompatible as of 23 Oct 2026
go get github.com/git-lfs/git-lfs@v2.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.1
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs@v3.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable support for symbolic links in Git by setting the 'core.symlinks' configuration option to 'false'. This can be done with the following command: 'git config --global core.symlinks false'. However, this will not affect existing symbolic or hard links in repositories.
Conclusion
In summary, CVE-2025-26625 is a significant vulnerability in Git LFS that can lead to arbitrary file writes due to improper handling of symbolic links. Users are strongly advised to upgrade to version 3.7.1 or later to mitigate this risk. For those unable to upgrade immediately, disabling symbolic link support can serve as a temporary measure.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
CVE-2025-26625 is a vulnerability in Git LFS that allows arbitrary file writes due to improper handling of symbolic links.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploiting this vulnerability can lead to unauthorized access or modification of files outside the intended working directory, potentially compromising system security.
You can upgrade Git LFS to version 3.7.1 or later using the command: 'go get github.com/git-lfs/git-lfs@v3.7.1'.
If you cannot upgrade immediately, consider disabling symbolic link support in Git as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
