CVE-2025-26625

Git LFS CVE-2025-26625 affects versions 0.5.2–3.7.0. When populating a working tree (and in bare repositories), git lfs checkout and git lfs pull may write to files outside the repository if crafted symbolic or hard links collide with paths tracked by Git LFS. The root cause is lack of checks for...

CVE-2025-26625 Git LFS may write to arbitrary files via crafted symlinks

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links...

CVE-2025-26625: Improper Link Resolution Before File Access

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links...

git-lfs -- Improper Link Resolution Before File Access

https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5 reports: Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may...

OPENSUSE-SU-2025:15643-1 git-lfs-3.7.1-1.1 on GA media

These are all security issues fixed in the git-lfs-3.7.1-1.1 package on the GA media of openSUSE Tumbleweed...

Git Lfs 后置链接漏洞

Git Lfs is a command line tool from the Git Lfs team for working with large files in git projects. A backlink vulnerability exists in Git Lfs versions 0.5.2 through 3.7.0, which stems from an unchecked symbolic link that could result in writing to an arbitrary file system location...

PT-2025-42616

Name of the Vulnerable Software and Affected Versions Git LFS versions 0.5.2 through 3.7.0 Description Git LFS commands, specifically git lfs checkout and git lfs pull, may write to files outside the intended Git working tree if symbolic or hard links are present that conflict with paths tracked ...

git-lfs security update

An update is available for git-lfs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, videos...

RLSA-2025:7256 Moderate: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: golang: crypto/tls: panic when processing post-handshake message on QUIC connections...

EUVD-2022-0965

Malicious code in bioql PyPI...

EUVD-2022-5497

Malicious code in bioql PyPI...

EUVD-2022-1652

Malicious code in bioql PyPI...

git-lfs security update

An update is available for git-lfs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, video...

KLA89352 OAF vulnerability in Git LFS

Path traversal vulnerability was found in Git LFS. Malicious users can exploit this vulnerability to overwrite arbitrary files. Original advisories Fixed in Git LFS 3.7.1 Exploitation Public exploits exist for this vulnerability. CVE list CVE-2025-26625 critical Solution Update to the latest...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: lvm-driver, prometheus-adapter, terraform-provider-time, pvc-autoresizer, prometheus-beat-exporter-fips, karpenter, secrets-store-csi-driver-provider-aws, configmap-reload-fips, gitsign, rancher-machine, gcp-compute-persistent-disk-csi-driver-fips, nemo, nats,...

SUSE SLED15: git / git-arch / git-core / git-credential-libsecret / git-cvs / etc (SUSE-SU-2025:03012-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03012-1 advisory. git was updated from version 2.43.0 to 2.51.0 bsc1243197: - Security issues fixed: CVE-2025-276...

security update for git, git-lfs, obs-scm-bridge, python-PyYAML

This update for git, git-lfs, obs-scm-bridge, python-PyYAML fixes the following issues: git was updated from version 2.43.0 to 2.51.0 bsc1243197: Security issues fixed: CVE-2025-27613 Fixed arbitrary writable file creation and truncation in Gitkbsc1245938 CVE-2025-27614 Fixed arbitrary script...

SUSE-SU-2025:03012-1 security update for git, git-lfs, obs-scm-bridge, python-PyYAML

This update for git, git-lfs, obs-scm-bridge, python-PyYAML fixes the following issues: git was updated from version 2.43.0 to 2.51.0 bsc1243197: - Security issues fixed: CVE-2025-27613 Fixed arbitrary writable file creation and truncation in Gitkbsc1245938 CVE-2025-27614 Fixed arbitrary script...

CVE-2025-58158: Improper Limitation of a Pathname to a Restricted Directory

Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server Gitness exposes api to retrieve and upload files via git LFS. Implementation ...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: mongo-tools, nri-discovery-kubernetes, conftest-fips, amazon-k8s-cni, db-operator, terraform-provider-azapi, kubecolor, packer, cluster-api-aws-controller, opentelemetry-collector, yace, docker-cli-buildx, authservice, k8sgpt, gatus, grafana-pyroscope,...