Critical Security Flaw in Git LFS: Arbitrary File Write Vulnerability
Summary
RLSA-2025:23667: Important: git-lfs security update. Affects git-lfs versions < 0:3.6.1-4.el10_1. Fixed in 0:3.6.1-4.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2025-26625 allows Git LFS to write to arbitrary files through crafted symbolic links. This can lead to unauthorized file modifications or overwrites, potentially compromising the integrity of the system. Attackers could exploit this vulnerability by tricking users into executing commands that leverage these symlinks, resulting in significant security breaches.
How To Fix
Minimum fixed version
0:3.6.1-4.el10_1
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using Git LFS with untrusted repositories or to disable symlink support if possible. This can be done by configuring Git settings to prevent symlink creation until the update is applied.
Conclusion
The Git LFS vulnerability CVE-2025-26625 poses a significant risk by allowing arbitrary file writes through crafted symlinks. It is crucial for users to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers in the repository.
CVE-2025-26625 refers to a security vulnerability in Git LFS that allows arbitrary file writes via crafted symlinks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If an immediate update is not possible, consider avoiding the use of Git LFS with untrusted repositories and disabling symlink support temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
