CVE-2025-26625
BaseFortify
Publication date: 2025-10-17
Last updated on: 2025-10-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| git-lfs | git-lfs | 3.7.1 |
| git-lfs | git-lfs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Git LFS (versions 0.5.2 through 3.7.0) occurs because certain Git LFS commands (git lfs checkout and git lfs pull) do not check for symbolic links before writing files. An attacker can craft a repository containing symbolic or hard links that cause Git LFS to write files outside the intended Git working tree, potentially overwriting arbitrary file system locations accessible to the user running these commands. This can also happen when these commands are run in a bare repository. The issue is fixed in version 3.7.1, and a workaround involves disabling symlink support in Git by setting core.symlinks to false.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to overwrite or write files outside the Git working tree, potentially leading to unauthorized modification of files on the user's system. This could result in data corruption, loss, or execution of malicious code if critical system or application files are overwritten. The impact depends on the permissions of the user running the Git LFS commands.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade Git LFS to version 3.7.1 or later. As a workaround, you can disable support for symbolic links in Git by setting the core.symlinks configuration option to false (git config --global core.symlinks false). Note that this will prevent creation of new symbolic links in future clones and fetches, but existing repositories with symbolic or hard links may still be vulnerable.