Summary
Ryota K discovered that Git LFS may leak login credentials in certain
instances due to failing to check for URL-encoded characters. An
attacker could possibly use this issue to learn sensitive information.
(CVE-2024-53263)
It was discovered that Git LFS could have its git lfs checkout and
git lfs pull commands abused to write to any file on a user's
system. An attacker could possibly use this issue to execute arbitrary
code. This issue was only addressed in Ubuntu 24.04 LTS and
Ubuntu 25.10. (CVE-2025-26625)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | git-lfs | 3.6.1-1ubuntu0.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | git-lfs | 2.3.4-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | git-lfs | 2.9.2-1ubuntu0.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | git-lfs | 3.0.2-1ubuntu0.3+esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | git-lfs | 3.4.1-1ubuntu0.3+esm2 |
Vulnerabilities 2
-
High 8.6
Git LFS may write to arbitrary files via crafted symlinks
Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git w…
-
High 8.5
Git LFS permits exfiltration of credentials via crafted HTTP URLs
Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then…