Critical Security Flaw in Git LFS: Arbitrary File Write Vulnerability
Summary
ALSA-2025:23744: Important: git-lfs security update. Affects git-lfs versions < 3.6.1-4.el9_7. Fixed in 3.6.1-4.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2025-26625 in Git LFS allows an attacker to exploit crafted symbolic links to write to arbitrary files on the system. This could lead to unauthorized access to sensitive data, system corruption, or other malicious activities. The issue arises from improper handling of symlinks, which can be manipulated to redirect file writes to unintended locations, posing a significant risk to system integrity and security.
How To Fix
Minimum fixed version
3.6.1-4.el9_7
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using Git LFS with untrusted repositories or files until the update is applied. Additionally, ensure that your system's permissions are configured to limit the potential impact of this vulnerability.
Conclusion
The Git LFS vulnerability CVE-2025-26625 presents a significant risk due to its potential for arbitrary file writes. Users are strongly encouraged to update to the latest version to mitigate this risk and ensure the security of their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files more efficiently by replacing them with text pointers and storing the actual files on a remote server.
CVE-2025-26625 refers to a security vulnerability in Git LFS that allows arbitrary file writes via crafted symlinks, posing a risk to system security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences can include unauthorized access to sensitive data, system corruption, and other malicious activities that could compromise system integrity.
It is recommended to regularly check for updates and apply them promptly to ensure that any known vulnerabilities are patched in your software.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
