Git LFS CVE-2025-26625

Git LFS is a Git extension written in Go that stores large binary files outside the main Git object store and materializes them into the working tree on checkout or pull. The root cause is CWE-59 (Link Following): prior to v3.7.1, the checkout and pull commands wrote LFS object content to target paths without first verifying that intermediate path components were not symbolic links, unlike Git itself which performs explicit symlink checks before writing. The patch (commits 0cffe93, 5c11ffc, d02bd13) introduces a new DirWalker abstraction in the tools package that walks each path component and refuses to traverse symlinks, and removes the unsafe MkdirAll call from lfs/gitfilter_smudge.go that previously created directories without symlink validation. A secondary issue allowed bare repositories to write outside their own directory under narrow conditions, which the same patch eliminates.