The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767003835 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7977-1 advisory.

    Ryota K discovered that Git LFS may leak login credentials in certain instances due to failing to check     for URL-encoded characters. An attacker could possibly use this issue to learn sensitive information.
    (CVE-2024-53263)

    It was discovered that Git LFS could have its git lfs checkout and git lfs pull commands abused to write     to any file on a user's system. An attacker could possibly use this issue to execute arbitrary code. This     issue was only addressed in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-26625)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - git-lfs - Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2     through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects,     certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or     hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git     lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an     attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary     file system locations accessible to the user running these commands. As well, when the git lfs checkout     and git lfs pull commands are run in a bare repository, they could write to files visible outside the     repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may     be disabled by setting the core.symlinks configuration option to false, after which further clones and     fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will     still provide the opportunity for Git LFS to write to their targets.  Ubuntu Linux - Git LFS is a Git     extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git     repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to     files visible outside the current Git working tree if symbolic or hard links exist which collide with the     paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for     symbolic links before writing to files in the working tree, allowing an attacker to craft a repository     containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations     accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull     commands are run in a bare repository, they could write to files visible outside the repository. The     vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by     setting the core.symlinks configuration option to false, after which further clones and fetches will not     create symbolic links. However, any symbolic or hard links in existing repositories will still provide the     opportunity for Git LFS to write to their targets. (CVE-2025-26625)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0846 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-47906:
    If the PATH environment variable contains paths which are executables (rather than just directories),     passing certain strings to LookPath (, ., and ..), can result in the binaries listed in the PATH     being unexpectedly returned.

    CVE-2025-26625:
    Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when     populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands     may write to files visible outside the current Git working tree if symbolic or hard links exist which     collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not     check for symbolic links before writing to files in the working tree, allowing an attacker to craft a     repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system     locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs     pull commands are run in a bare repository, they could write to files visible outside the repository. The     vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by     setting the core.symlinks configuration option to false, after which further clones and fetches will not     create symbolic links. However, any symbolic or hard links in existing repositories will still provide the     opportunity for Git LFS to write to their targets.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:23744 advisory.

    * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0465 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006283 advisory.

    Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when     populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands     may write to files visible outside the current Git working tree if symbolic or hard links exist which     collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not     check for symbolic links before writing to files in the working tree, allowing an attacker to craft a     repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system     locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs     pull commands are run in a bare repository, they could write to files visible outside the repository. The     vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by     setting the core.symlinks configuration option to false, after which further clones and fetches will not     create symbolic links. However, any symbolic or hard links in existing repositories will still provide the     opportunity for Git LFS to write to their targets.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21621-1 advisory.

    Changes in git-lfs:

    - update to 3.7.1: (boo#1252259 CVE-2025-26625)

      This release introduces security fixes for Linux, macOS, and       Windows systems, which have been collectively assigned       CVE-2025-26625.

      When populating a Git repository's working tree with the contents       of Git LFS objects, certain Git LFS commands may write to files       visible outside the current Git working tree if symbolic or hard       links exist which collide with the paths of files tracked by Git       LFS.

      Git LFS has resolved this problem by revising the git lfs       checkout and git lfs pull commands so that they check for       symbolic links in the same manner as performed by Git before       writing to files in the working tree.  These commands now also       remove existing files in the working tree before writing new       files in their place.

      As well, Git LFS has resolved a problem whereby the git lfs       checkout and git lfs pull commands, when run in a bare       repository, could write to files visible outside the repository.
      While a specific and relatively unlikely set of conditions were       required for this to occur, it is no longer possible under any       circumstances.

      We would like to extend a special thanks to the following       open-source contributors:
        Apple Product Security for reporting this to us responsibly

      * Bugs
        - Detect symbolic links on checkout and pull (@chrisd8088)
      * Misc
        - Upgrade to Go 1.25 (@chrisd8088)

    - update to 3.7.0

      This release is a feature release which introduces several new options       for fetching Git LFS objects, such as the ability to force objects       to be re-downloaded and the capacity to output object URLs and HTTP       metadata in JSON for external tools to consume. This release also       adds a configurable in-memory cache of file path pattern matches,       which along with other changes can help reduce the time required to       migrate large repositories to Git LFS.

      Git LFS now supports the same .netrc files on Windows as Git and       curl, retries appropriately after all 429 status code HTTP       responses, permits the use of symbolic links to Git's object       storage during Git LFS migrations

      - Features
        - Cache a file path filter match result #6047 (@alexkad0)
        - Add --refetch option to fetch #5975 (@redsun82)
        - Add --json option to fetch #5974 (@redsun82)
        - Add --dry-run option to fetch #5973 (@redsun82)
      - Bugs
        - Verify TLS/SSL certificates using default Go support for           macOS system root CAs #6049 (@chrisd8088)
        - Prefer .netrc on windows if present #6055 (@johanvdw)
        - Fix migrations where .git/objects is a symlink #6042           (@bk2204)
        - Honour 429 object transfer response Retry-After headers #6014           (@chrisd8088)
      - Misc
        - Update Linux distribution package list for v3.7.0 release           (@chrisd8088)
        - Report missing objects consistently when pushing #6027           (@chrisd8088)
        - Use a git-update-ref script to update references #6048           (@alexkad0)
        - Drop unused generic stub function for cloning files #6050           (@chrisd8088)
        - Prevent conflicting curl macros in early Git version CI jobs           #6040 (@chrisd8088)
        - pull: improve error message on failing checkout #5629           (@bk2204)
        - Fix language in code snippets in API docs #6035           (@slonopotamus)
        - build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0           #6034 (@dependabot[bot])
        - Use single-target Makefile patterns for manual pages #6032           (@chrisd8088)
        - use direct value nil for error #6024 (@alingse)
        - Update minimum required Git version checks #6028           (@chrisd8088)
        - build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0           #6012 (@dependabot[bot])
        - Upgrading x/crypto to v0.35.0 to solve CVE-2025-22869 bsc#1239322           #5997 (@gergelyfabian)
        - Upgrade to Go 1.24 #6013 (@chrisd8088)
        - Use constant format strings and fix HTTP error messages #5998           (@chrisd8088)
        - Remove command name prefixes from progress messages #5995           (@chrisd8088)
        - doc: Add missing --to argument in git-lfs-checkout example           #6005 (@DarkDefender)
        - Replace min/max helpers with built-in min/max #5999           (@Juneezee)
        - Add security patch release process documentation #5987           (@chrisd8088)
        - Replace unused debug mode with trace logging #5989           (@chrisd8088)
        - Use default Ruby provided by Actions runners #5984           (@chrisd8088)
        - build(deps): bump azure/trusted-signing-action from 0.5.0 to           0.5.1 #5981 (@dependabot[bot])
        - Update workflows to use ARM runners and new Apple signing           certificate #5977 (@chrisd8088)
        - docs/man/git-lfs-prune.adoc: fix --(no-)verify-unreachable           description #5959 (@m3ka24)
        - docs/man/git-lfs-migrate.adoc: remove duplicate flag #5944           (@fedirz)
        - Upgrade golang.org/x/net from 0.23.0 to 0.33.0 #5940           (@gergelyfabian)
        - build(deps): bump golang.org/x/crypto from 0.21.0 to 0.31.0           #5935 (@dependabot[bot])
        - Simplify macOS CI jobs and specify Go toolchain version #5931           (@chrisd8088)
        - Tighten security of Actions workflows #5930 (@bk2204)
        - Corrected Pop!_OS naming #5929 (@LucasDondo)
        - Update release process documentation and scripts #5920           (@chrisd8088)
        - Update license copyright dates and minimum supported Git           version #5921 (@chrisd8088)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3801-1 advisory.

    This update for git-lfs fixes the following issue:

    - CVE-2025-26625: certain commands may write to files visible outside the current Git working tree if     links which       collide with the paths of files tracked by Git LFS exist (bsc#1252259).

    Changes for git-lfs:

    - update to 3.7.1

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23927 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * resolv: Denial of Service in resolv gem (CVE-2025-24294)

    * rexml: REXML denial of service (CVE-2025-58767)

    * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
361042	AlmaLinux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2025:1767003835)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/2	high
296749	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Git LFS vulnerabilities (USN-7977-1)	Nessus	Ubuntu Local Security Checks	2026/1/27	2026/1/27	high
271684	Linux Distros Unpatched Vulnerability : CVE-2025-26625	Nessus	Misc.	2025/10/27	2026/10/21	high
272240	TencentOS Server 4: git-lfs (TSSA-2025:0846)	Nessus	Tencent Local Security Checks	2025/11/4	2025/12/4	high
279619	AlmaLinux 9 : git-lfs (ALSA-2025:23744)	Nessus	Alma Linux Local Security Checks	2025/12/23	2025/12/23	high
283536	RHEL 8 : git-lfs (RHSA-2026:0465)	Nessus	Red Hat Local Security Checks	2026/1/13	2026/1/13	high
303358	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: git-lfs (UTSA-2026-006283)	Nessus	Unity Linux Local Security Checks	2026/3/23	2026/3/23	high
339037	openSUSE 16 Security Update : git-lfs (openSUSE-SU-2026:21621-1)	Nessus	SuSE Local Security Checks	2026/8/23	2026/8/23	high
340997	SUSE SLED15 / SLES15 Security Update : git-lfs (SUSE-SU-2026:3801-1)	Nessus	SuSE Local Security Checks	2026/8/27	2026/8/29	high
279550	RHEL 10 : ruby (RHSA-2025:23927)	Nessus	Red Hat Local Security Checks	2025/12/22	2025/12/22	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high