PT-2025-35297 · Harness · Gitness +1

Thekavorka · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-58158

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Harness Open Source versions prior to 3.3.0

Description:

Harness Open Source’s git Large File Storage (LFS) server (Gitness) exposes APIs for retrieving and uploading files via git LFS. The implementation of the upload git LFS file API is susceptible to arbitrary file write due to improper sanitization of the upload path. An authenticated user with access to the Harness Gitness server API can craft a malicious upload request to write arbitrary files to any location on the file system, potentially compromising the server. Users utilizing git LFS are affected.

Recommendations:

Upgrade to version 3.3.0 to resolve this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2025-58158

GHSA-W469-HJ2F-JPR5

Affected Products

Gitness

Harness Open Source

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-58158 · Security Note
• https://osv.dev/vulnerability/GHSA-w469-hj2f-jpr5 · Vendor Advisory
• https://github.com/harness/harness · Note
• https://github.com/harness/harness/security/advisories/GHSA-w469-hj2f-jpr5 · Note
• https://github.com/harness/harness/commit/21c5ce42ae13740b1cad47706c2ec85e72cc8c20 · Note
• https://twitter.com/VulmonFeeds/status/1961515560857964783 · Twitter Post
• https://t.me/CVEtracker/31271 · Telegram Post
• https://twitter.com/CVEnew/status/1961494211213033775 · Twitter Post
• https://twitter.com/CveFindCom/status/1961491658400247812 · Twitter Post