Detections
Analytics

Echo: git-lfs: security update to 3.6.1-1+e1

high Tenable Cloud Security Plugin ID 460047

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when
 populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands
 may write to files visible outside the current Git working tree if symbolic or hard links exist which
 collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not
 check for symbolic links before writing to files in the working tree, allowing an attacker to craft a
 repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system
 locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs
 pull commands are run in a bare repository, they could write to files visible outside the repository. The
 vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by
 setting the core.symlinks configuration option to false, after which further clones and fetches will not
 create symbolic links. However, any symbolic or hard links in existing repositories will still provide the
 opportunity for Git LFS to write to their targets. (CVE-2025-26625)

Solution

Update the git-lfs library and its related packages to version 3.6.1-1+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-26625

Plugin Details

Severity: High

ID: 460047

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

CVSS v4

Risk Factor: High

Base Score: 8.6

Threat Score: 6.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2025-26625

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/17/2025

Vulnerability Publication Date: 10/17/2025

Reference Information

CVE: CVE-2025-26625