Read the docs
TI-2025-35974 Aliases CVE-2025-58158GHSA-w469-hj2f-jpr5

Harness Affected by Arbitrary File Write in Gitness LFS server

Priority MEDIUM 41CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server (Gitness) exposes api to retrieve and upload files via git LFS. Implementation of upload git LFS file api is vulnerable to arbitrary file write. Due to improper sanitization for upload path, a malicious authenticated user who has access to Harness Gitness server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromise the server. Users using git LFS are vulnerable. This issue has been patched in version 3.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix Fixed harness (harness): 3.3.0github.com/harness/gitness (Go): 3.3.0, 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
harnessharnessbefore 3.3.03.3.0Patch availableCNA
—github.com/harness/gitness (Go)1.0.4 to before 3.3.03.3.0Patch availableGHSA-w469-hj2f-jpr5
—github.com/harness/gitness (Go)before 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae131.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13Patch availableGHSA-w469-hj2f-jpr5
  • harness Vendorharness Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA
  • github.com/harness/gitness (Go) Vendor— Affected 1.0.4 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-w469-hj2f-jpr5
  • github.com/harness/gitness (Go) Vendor— Affected before 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13 Fixed in 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13 Patch available GHSA-w469-hj2f-jpr5

Remediation

  • Fix · CNA harness (harness) Fixed in 3.3.0
  • Fix · GHSA-w469-hj2f-jpr5 github.com/harness/gitness (Go) Fixed in 3.3.0 Advisory →
  • Fix · GHSA-w469-hj2f-jpr5 github.com/harness/gitness (Go) Fixed in 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58158
  2. 2026-10-03 Alias added: GHSA-w469-hj2f-jpr5

References

Advisory 1

Other 3

  • TI-2026-62496 Harness through 3.3.0 Missing Access Control via infraproviders endpoint CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences