Critical Security Flaw in Git LFS: Arbitrary File Write Vulnerability
Summary
ALSA-2025:23745: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-6.el8_10. Fixed in 3.4.1-6.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics more efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who work with large assets, enabling faster cloning and reduced repository size. However, a recent vulnerability has been identified that could allow unauthorized file writes, posing a significant security risk.
Vulnerability Detail
The vulnerability identified as CVE-2025-26625 allows Git LFS to write to arbitrary files through crafted symlinks. This means that an attacker could potentially manipulate the symlink to redirect file writes to unintended locations on the filesystem, leading to data corruption, unauthorized access, or even system compromise. The issue arises from improper validation of symlink targets, which can be exploited if a user interacts with maliciously crafted Git repositories.
How To Fix
Minimum fixed version
3.4.1-6.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using Git LFS with untrusted repositories until the update is applied. Additionally, ensure that symlink handling is restricted in environments where sensitive data is stored.
Conclusion
The vulnerability in Git LFS, identified as CVE-2025-26625, poses a serious risk by allowing arbitrary file writes through crafted symlinks. Users are strongly encouraged to update to the latest patched version to mitigate this risk. Until then, exercising caution with untrusted repositories is advisable.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers and storing the actual content on a remote server.
CVE-2025-26625 is a security vulnerability in Git LFS that allows arbitrary file writes via crafted symlinks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using Git LFS with untrusted repositories and restrict symlink handling in your environment.
For more details, refer to the CVE page associated with CVE-2025-26625, which provides insights into the impact and technical aspects of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
