Search: CVE-2025-26625

Git LFS versions 0.5.2 through 3.7.0 contain a vulnerability where the git lfs checkout and git lfs pull commands do not properly check for symbolic or hard links before writing files. This can lead to Git LFS writing files outside the intended Git working tree, potentially overwriting arbitrary file system locations accessible to the user. The issue also affects bare repositories. The vulnerability is fixed in version 3.7.1. A workaround involves disabling symlink support via the core.symlinks configuration, but existing repositories with links remain vulnerable.