Git for Windows blocks NTLM hash leak via symlink probes

Git for Windows has closed a path that let a malicious repository steal a user's NTLMv2 credentials during clone. The fix, from Johannes Schindelin, stops the client from auto-detecting whether a symlink points to a file or a directory when the target looks like a network share.

On Windows, Git must choose between file and directory symlink types. When the target does not yet exist, it creates a temporary file symlink and later probes the destination. A UNC path pointing at an attacker-controlled share causes Windows to open an SMB connection and perform NTLM authentication by default. An attacker who tricks a user into cloning with core.symlinks enabled can therefore capture the hash with no further interaction.

The patch treats paths that begin like UNC forms (a leading single backslash) as potential network targets and skips the probe. The link is left as a file symlink and a warning suggests setting the symlink gitattribute to dir when a directory link is needed. The change is the same class of issue as CVE-2025-66413 and follows the mitigation pattern MinTTY used for network-share references in ANSI sequences.

Legitimate drive-relative absolute paths that also start with a backslash become slightly less convenient, but those cases are uncommon.