Skip to content
Fencer Vulns
high 8.6

CVE-2025-26625 json

Git LFS may write to arbitrary files via crafted symlinks

published 2025-10-17 12 mo ago modified 2026-10-22 18 d ago also BIT-git-lfs-2025-26625 , EUVD-2025-34886 , GHSA-6pvw-g552-53c5 , GO-2025-4038

cvss
8.6
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.

Patch / fix

  • go github.com/git-lfs/git-lfs 3.7.1
  • bitnami git-lfs 3.7.1
  • go github.com/git-lfs/git-lfs/v3 3.7.1
  • git_large_file_storage_project git_large_file_storage 3.7.1
  • git-lfs Debian 12 3.3.0-1+deb12u2
  • git-lfs Debian 13 3.6.1-1+deb13u1
  • git-lfs Debian 14 3.7.1-1

debian advisories DEBIAN-CVE-2025-26625

  • git-lfs Ubuntu 25.10 3.6.1-1ubuntu0.1
  • git-lfs Ubuntu Pro 24.04 LTS 3.4.1-1ubuntu0.3+esm2

ubuntu advisories UBUNTU-CVE-2025-26625

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • git-lfs RHEL 8 3.4.1-6.el8_10
  • git-lfs RHEL 9 3.6.1-4.el9_7
  • git-lfs RHEL 10.1 3.6.1-4.el10_1
  • git-lfs RHEL 9.0 E4S 2.13.3-5.el9_0.5
  • git-lfs RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 2.13.3-3.el8_6.5
  • git-lfs RHEL 8.8 TUS, RHEL 8.8 E4S 3.2.0-2.el8_8.5
  • git-lfs RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 2.13.3-3.el8_4.3
  • git-lfs enterprise linux eus 10.0 3.6.1-2.el10_0.1

red hat advisories RHSA-2026:0472RHSA-2026:0465RHSA-2026:0460RHSA-2026:0459RHSA-2026:0224RHSA-2026:0203

  • git-lfs SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 3.7.1-150600.13.6.1

suse advisories SUSE-SU-2026:3801-1

  • git-lfs openSUSE Leap 16.0 3.7.1-bp160.1.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20251105T184115-1.1
  • git-lfs openSUSE Tumbleweed 3.7.1-1.1

opensuse advisories openSUSE-SU-2026:21621-1openSUSE-SU-2026:21483-1openSUSE-SU-2025:15710-1openSUSE-SU-2025:15643-1

  • git-lfs AlmaLinux 9 3.6.1-4.el9_7
  • git-lfs AlmaLinux 8 3.4.1-6.el8_10
  • git-lfs AlmaLinux 10 3.6.1-4.el10_1

almalinux advisories ALSA-2025:23744ALSA-2025:23745ALSA-2025:23667

  • git-lfs Rocky Linux 9 3.6.1-4.el9_7
  • git-lfs Rocky Linux 8 3.4.1-6.el8_10
  • git-lfs Rocky Linux 10 3.6.1-4.el10_1

rocky linux advisories RLSA-2025:23744RLSA-2025:23745RLSA-2025:23667

  • git-lfs Alpine 3.24, Alpine 3.23 3.7.1-r0

alpine advisories ALPINE-CVE-2025-26625

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-26625 updated cvss 8.1

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

  • Red Hat Enterprise Linux AppStream (v. 8) git-lfs 3.4.1-6.el8_10
    fixed: vendor fix RHSA-2025:23745
  • Red Hat Enterprise Linux AppStream (v. 9) git-lfs 3.6.1-4.el9_7
    fixed: vendor fix RHSA-2025:23744
  • Red Hat Enterprise Linux AppStream (v. 10) git-lfs 3.6.1-4.el10_1
    fixed: vendor fix RHSA-2025:23667
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) git-lfs 2.13.3-3.el8_4.3
    fixed: vendor fix RHSA-2026:0459
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) git-lfs 2.13.3-3.el8_6.5 Red Hat Enterprise Linux AppStream E4S (v.8.6) git-lfs 2.13.3-3.el8_6.5
    fixed: vendor fix RHSA-2026:0465
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) git-lfs 3.2.0-2.el8_8.5
    fixed: vendor fix RHSA-2026:0460
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) git-lfs 2.13.3-5.el9_0.5
    fixed: vendor fix RHSA-2026:0472
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) git-lfs 3.2.0-2.el9_2.4
    fixed: vendor fix RHSA-2026:0203
show 7 more
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ruby 3.3.10-11.el10_0, git-lfs 3.6.1-2.el10_0.1, rubygems 3.5.22-11.el10_0, ruby-libs 3.3.10-11.el10_0, rubygem-rbs 3.4.0-11.el10_0, rubygem-rss 0.3.1-11.el10_0, +16 more
    fixed: vendor fix RHSA-2026:0224
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) git-lfs 3.4.1-4.el9_4.3
    fixed: vendor fix RHSA-2026:0204
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) git-lfs 3.6.1-2.el9_6.1, ruby 3.3.10-5.module+el9.6.0+23780+e40d2335, rubygems 3.5.22-5.module+el9.6.0+23780+e40d2335, ruby-libs 3.3.10-5.module+el9.6.0+23780+e40d2335, rubygem-pg 1.5.4-1.module+el9.4.0+21222+faeeed2f, rubygem-rbs 3.4.0-5.module+el9.6.0+23780+e40d2335, +18 more
    fixed: vendor fix RHSA-2026:0199
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) git-lfs 2.13.3-3.el8_4.3
    fixed: vendor fix RHSA-2026:0459
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) git-lfs 2.13.3-3.el8_6.5
    fixed: vendor fix RHSA-2026:0465
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) git-lfs 3.2.0-2.el8_8.5
    fixed: vendor fix RHSA-2026:0460
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) ruby-doc 3.3.10-11.el10_0
    fixed: vendor fix RHSA-2025:23927

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
12 mo ago

Exploit prediction

1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 4.0 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go github.com/git-lfs/git-lfs
>=0.5.2, <3.7.1
>=0.5.2
3.7.1
bitnami git-lfs
>=0.5.2, <3.7.1
3.7.1
go github.com/git-lfs/git-lfs/v3
<3.7.1
3.7.1

Affected products

  • git-lfs git-lfs

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.