CVE-2025-58158

Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server (Gitness) exposes api to retrieve and upload files via git LFS. Implementation of upload git LFS file api is vulnerable to arbitrary file write. Due to improper sanitization for upload path, a malicious authenticated user who has access to Harness Gitness server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromise the server. Users using git LFS are vulnerable. This issue has been patched in version 3.3.0.

• CWE-22
• CWE-73

• https://github.com/harness/harness/commit/21c5ce42ae13740b1cad47706c2ec85e72cc8c20
• https://github.com/harness/harness/security/advisories/GHSA-w469-hj2f-jpr5

Published

Aug 29, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58150Shadow mode tracing code uses a set of per-CPU variables to …8.8
• CVE-2025-58151varstored is a component of the Xapi toolstack handling UEFI…9.4
• CVE-2025-58152FutureNet MA and IP-K series provided by Century Systems Co.…6.9
• CVE-2025-58153Under undisclosed traffic conditions along with conditions b…5.9
• CVE-2025-58156Centurion ERP is an ERP with a focus on ITSM and automation.…4.3
• CVE-2025-58157gnark is a zero-knowledge proof system framework. In version…7.5
• CVE-2025-58159WeGIA is a Web manager for charitable institutions. Prior to…8.8
• CVE-2025-5816The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kar…4.3
• CVE-2025-58160tracing is a framework for instrumenting Rust programs to co…2.3
• CVE-2025-58161MobSF is a mobile application security testing tool used. In…4.3
• CVE-2025-58162MobSF is a mobile application security testing tool used. In…6.5
• CVE-2025-58163FreeScout is a free help desk and shared inbox built with PH…8.8