PT-2025-35297 · Harness · Harness Open Source+1

Thekavorka · Published 2025-08-29 · Updated 2025-10-08 · CVE-2025-58158

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Harness Open Source versions prior to 3.3.0

Description Harness Open Source’s git Large File Storage (LFS) server (Gitness) exposes APIs for retrieving and uploading files via git LFS. The implementation of the upload git LFS file API is susceptible to arbitrary file write due to improper sanitization of the upload path. An authenticated user with access to the Harness Gitness server API can craft a malicious upload request to write arbitrary files to any location on the file system, potentially compromising the server. Users utilizing git LFS are affected.

Recommendations Upgrade to version 3.3.0 to resolve this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2025-58158

GHSA-W469-HJ2F-JPR5

GO-2025-3926

SUSE-SU-2025:03289-1

Affected Products

Gitness

Harness Open Source

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58158.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-58158 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w469-hj2f-jpr5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58158 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3926 · Vendor Advisory
• https://github.com/harness/harness/commit/21c5ce42ae13740b1cad47706c2ec85e72cc8c20 · Note
• https://github.com/harness/harness/security/advisories/GHSA-w469-hj2f-jpr5 · Note
• https://github.com/harness/harness · Note
• https://suse.com/security/cve/CVE-2025-58157 · Note
• https://suse.com/security/cve/CVE-2025-9076 · Note
• https://suse.com/security/cve/CVE-2025-59360 · Note
• https://suse.com/security/cve/CVE-2025-54467 · Note
• https://twitter.com/CveFindCom/status/1961491658400247812 · Twitter Post
• https://suse.com/security/cve/CVE-2025-59361 · Note