Overview
The cybersecurity community has recently discovered a significant vulnerability in the Harness Open Source end-to-end developer platform. Identified as CVE-2025-58158, this flaw affects the git LFS server (Gitness) component of the platform. Given the widespread use of this software by developers around the world, the vulnerability has serious implications for numerous systems and applications.
The importance of this vulnerability lies in its potential for exploitation. A malicious, authenticated user with access to the Harness Gitness server API can craft an upload request, allowing them to write an arbitrary file to any location on the file system. This could potentially compromise the server, leading to data leakage or even a full system takeover.
Vulnerability Summary
CVE ID: CVE-2025-58158
Severity: High (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise, data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Harness Open Source | Versions prior to 3.3.0
How the Exploit Works
The exploit takes advantage of a flaw in the implementation of the upload git LFS file API. The vulnerability arises from improper sanitization of the upload path, which means an attacker can manipulate the path to write files to any location on the file system. A successful exploit could lead to unauthorized access and control of the server, paving the way for data theft or further system compromise.
Conceptual Example Code
A malicious user might exploit this vulnerability by sending a crafted HTTP request as follows:
POST /api/git-lfs/upload HTTP/1.1
Host: harness.example.com
Content-Type: application/json
Authorization: Bearer [auth_token]
{
"filename": "../../../../../../../etc/passwd",
"content": "malicious_content"
}In this hypothetical example, the attacker is attempting to overwrite the ‘/etc/passwd’ file, which is a crucial system file on Unix-based systems, with malicious content. If successful, this could give the attacker elevated privileges on the system.
Fix and Mitigation
Harness has released a patch for this vulnerability in version 3.3.0 of their Open Source platform. All users are strongly encouraged to update to this version or later to mitigate this vulnerability. If immediate patching is not possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation.
