x/vulndb: potential Go vuln in github.com/git-lfs/git-lfs: GHSA-6pvw-g552-53c5

[GoVulnBot]

Advisory GHSA-6pvw-g552-53c5 references a vulnerability in the following Go modules:

Module
github.com/git-lfs/git-lfs

Description:

Impact

When populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS.

Git LFS has resolved this problem by revising the git lfs checkout and git lfs pull commands so that they check for symbolic links in the same manner as performed by Git before writing to files in the working tree. These commands now also remove existing files in the working tree before writing new files in their pl...

References:

• ADVISORY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26625
• ADVISORY: GHSA-6pvw-g552-53c5
• ADVISORY: GHSA-6pvw-g552-53c5
• FIX: git-lfs/git-lfs@0cffe93
• FIX: git-lfs/git-lfs@5c11ffc
• FIX: git-lfs/git-lfs@d02bd13
• WEB: https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1

Cross references:

• github.com/git-lfs/git-lfs appears in 5 other report(s):
  • data/excluded/GO-2022-0432.yaml (x/vulndb: potential Go vuln in github.com/git-lfs/git-lfs: CVE-2022-24826 #432) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2022-0789.yaml (x/vulndb: potential Go vuln in github.com/git-lfs/git-lfs: GHSA-4g4p-42wc-9f3m #789) NOT_IMPORTABLE
  • data/reports/GO-2021-0073.yaml (dummy issue #73)
  • data/reports/GO-2021-0098.yaml (dummy issue #98)
  • data/reports/GO-2025-3390.yaml (x/vulndb: potential Go vuln in github.com/git-lfs/git-lfs: CVE-2024-53263 #3390)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/git-lfs/git-lfs
      non_go_versions:
        - introduced: TODO (earliest fixed "3.7.1", vuln range ">= 0.5.2, <= 3.7.0")
      vulnerable_at: 1.5.6
summary: Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs
cves:
    - CVE-2025-26625
ghsas:
    - GHSA-6pvw-g552-53c5
references:
    - advisory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26625
    - advisory: https://github.com/advisories/GHSA-6pvw-g552-53c5
    - advisory: https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5
    - fix: https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396
    - fix: https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8
    - fix: https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615
    - web: https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1
source:
    id: GHSA-6pvw-g552-53c5
    created: 2025-10-17T18:01:23.468411954Z
review_status: UNREVIEWED