Critical Security Flaw in Git LFS: Arbitrary File Write Vulnerability
Summary
RLSA-2025:23744: Important: git-lfs security update. Affects git-lfs versions < 0:3.6.1-4.el9_7. Fixed in 0:3.6.1-4.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with lightweight text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2025-26625 allows Git LFS to write to arbitrary files through crafted symbolic links. This can lead to unauthorized file modifications or overwrites, potentially compromising the integrity of the system. Attackers could exploit this vulnerability by manipulating the symbolic links to redirect file writes to sensitive locations, leading to data loss or corruption. The severity of this vulnerability is underscored by its CVSS score of 8.1, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
0:3.6.1-4.el9_7
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Git LFS for sensitive files or ensure that symbolic links are not used in a way that could be exploited. Additionally, restricting file permissions and monitoring file access can help mitigate the risk until the package is updated.
Conclusion
The Git LFS vulnerability CVE-2025-26625 poses a significant risk due to its ability to allow arbitrary file writes through crafted symbolic links. Users are strongly encouraged to update to the latest patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files efficiently by replacing them with text pointers and storing the actual files on a remote server.
CVE-2025-26625 refers to a security vulnerability in Git LFS that allows arbitrary file writes via crafted symbolic links.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
If an immediate update is not possible, consider using workarounds such as avoiding the use of Git LFS for sensitive files and monitoring file access.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
