CVE-2025-26625: Git LFS arbitrary file write via symbolic link traversal

CVE-2025-26625 · Severity: high · CVSS 4 · Published 2025-10-17

Git LFS is a tool used to manage large files in Git repositories. A vulnerability exists where specially crafted repositories containing symbolic or hard links can trick the tool into writing files to locations outside of the intended project folder. This could allow an attacker to overwrite sensitive system files or configuration data if a user clones or updates a malicious repository.

Technologies: github.com/git-lfs/git-lfs (Go), github.com/git-lfs/git-lfs/v3 (Go). Vendors: Go.

Quick answers

Is CVE-2025-26625 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-26625 being exploited in the wild.
How severe is CVE-2025-26625?
High severity, with a CVSS score of 4, published 17 October 2025.
Which products and versions are affected?
Git LFS Project Git LFS >= 0.5.2, <= 3.7.0, 0.5.2 through 3.7.0; github.com/git-lfs/git-lfs (Go) >= 0.5.2, <= 3.7.0, SEMVER:introduced=0.5.2, SEMVER:introduced=0.5.2,fixed=3.7.1; github.com/git-lfs/git-lfs/v3 (Go) SEMVER:introduced=0,fixed=3.7.1.
Is there a fix for CVE-2025-26625?
Yes. github.com/git-lfs/git-lfs (Go): upgrade to 3.7.1 or later; github.com/git-lfs/git-lfs/v3 (Go): upgrade to 3.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-26625 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-26625?
Check whether you run Git LFS Project Git LFS, github.com/git-lfs/git-lfs (Go) or github.com/git-lfs/git-lfs/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/git-lfs/git-lfs (Go): upgrade to 3.7.1 or later
    go get github.com/git-lfs/git-lfs@v3.7.1
  • github.com/git-lfs/git-lfs/v3 (Go): upgrade to 3.7.1 or later
    go get github.com/git-lfs/git-lfs/v3@v3.7.1

Technical details

A link-following vulnerability (CWE-59) exists in Git LFS versions 0.5.2 through 3.7.0. When executing 'git lfs checkout' or 'git lfs pull', the application fails to properly validate if path components in the working tree are symbolic links before writing LFS object contents. An attacker can craft a repository where a tracked LFS file path collides with a symbolic or hard link pointing outside the repository boundaries. This allows arbitrary file writes on the victim's filesystem when the repository is populated. The fix, introduced in version 3.7.1, implements path validation similar to core Git, ensuring each path component is a directory and removing existing files before writing new ones.

Affected products

  • Git LFS git-lfs >= 0.5.2, <= 3.7.0

Identifiers

  • CVE-2025-26625
  • GHSA-6pvw-g552-53c5
  • GO-2025-4038

Timeline

  • 2025-10-17: advisory: GHSA-6pvw-g552-53c5 published
  • 2025-10-17: patched: Version 3.7.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.