CVE-2025-26625: Git LFS Arbitrary File Write Vulnerability via Crafted Symlinks
Summary
CVE-2025-26625: Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs. Affects github.com/git-lfs/git-lfs versions >= 0.5.2. No fix is published. How to fix ↓
Also tracked for
- git-lfs · Bitnami
The same CVE-2025-26625 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS (Large File Storage) is an extension for Git that allows users to manage large files more efficiently. It replaces large files in your repository with text pointers inside Git, while storing the file contents on a remote server. This functionality is crucial for developers who work with large assets, such as media files or datasets. However, a vulnerability has been identified in Git LFS that allows for arbitrary file writes due to crafted symlinks, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the way Git LFS handles symlinks. An attacker can create a malicious symlink that, when processed by Git LFS, can lead to the overwriting of arbitrary files on the system. This could result in data loss, unauthorized access to sensitive information, or even system compromise. The issue was introduced in version 0.5.2 and affects all subsequent versions up to 3.7.0. The specific functions impacted include checkoutCommand, checkoutConflict, newSingleCheckout, singleCheckout.Run, and GitFilter.SmudgeToFile.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using Git LFS for files that may be susceptible to symlink attacks. Additionally, ensure that your system's permissions are set correctly to limit the ability of untrusted users to create symlinks.
Conclusion
The Git LFS vulnerability (CVE-2025-26625) poses a serious risk by allowing arbitrary file writes through crafted symlinks. Users are strongly advised to update to version 3.7.1 or later to mitigate this risk. For those unable to update immediately, implementing workarounds can help reduce exposure.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
Git LFS (Large File Storage) is an extension for Git that helps manage large files by replacing them with pointers in the repository.
This vulnerability allows attackers to write to arbitrary files on your system, which can lead to data loss or unauthorized access.
Versions of Git LFS starting from 0.5.2 up to 3.7.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If you cannot update immediately, consider implementing strict file permissions and avoid using Git LFS for untrusted files as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
