Risk
This behavior breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access.
Impact
User with push permission to any repository will be able to access any server files accessible by server process
Patches
15.0.2
Finder Credits
Risk
This behavior breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access.
Impact
User with push permission to any repository will be able to access any server files accessible by server process
Patches
15.0.2
Finder Credits