ghsa-w469-hj2f-jpr5
Vulnerability from github
Published
2025-08-29 16:41
Modified
2025-08-29 21:09
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Harness Allows Arbitrary File Write in Gitness LFS server
Details

Impact

Open Source Harness git LFS server (Gitness) exposes api to retrieve and upload files via git LFS. Implementation of upload git LFS file api is vulnerable to arbitrary file write. Due to improper sanitization for upload path, a malicious authenticated user who has access to Harness Gitness server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromise the server.

Users using git LFS are vulnerable.

Patches

Users have to upgrade to v3.3.0 . All previous versions are affected by this vulnerability.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/harness/gitness"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.4"
            },
            {
              "fixed": "3.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/harness/gitness"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-58158"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-29T16:41:57Z",
    "nvd_published_at": "2025-08-29T18:15:42Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nOpen Source Harness git LFS server (Gitness)  exposes api to retrieve and upload files via git LFS.  Implementation of upload git LFS file api is vulnerable to arbitrary file write.  Due to improper sanitization for upload path, a malicious authenticated user who has access to Harness Gitness server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromise the server. \n\nUsers using git LFS are vulnerable.\n\n### Patches\nUsers have to upgrade to v3.3.0 . All previous versions are affected by this vulnerability.",
  "id": "GHSA-w469-hj2f-jpr5",
  "modified": "2025-08-29T21:09:11Z",
  "published": "2025-08-29T16:41:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/harness/harness/security/advisories/GHSA-w469-hj2f-jpr5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58158"
    },
    {
      "type": "WEB",
      "url": "https://github.com/harness/harness/commit/21c5ce42ae13740b1cad47706c2ec85e72cc8c20"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/harness/harness"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Harness Allows Arbitrary File Write in Gitness LFS server"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.