CVE-2025-58158
BaseFortify
Publication date: 2025-08-29
Last updated on: 2025-09-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| harness | gitness | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58158 is a high-severity vulnerability in the Harness Gitness Git LFS server prior to version 3.3.0. It arises from improper input validation in the Git LFS file upload API, specifically due to insufficient sanitization of the upload path. This flaw allows an authenticated malicious user with access to the Gitness server API to craft upload requests that write arbitrary files to any location on the server's filesystem, potentially leading to full server compromise. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a malicious authenticated user to write arbitrary files anywhere on the server's filesystem. This can lead to a full compromise of the server, affecting confidentiality, integrity, and availability of the system at a high level. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for suspicious or unauthorized Git LFS upload API requests to the Harness Gitness server, especially those from authenticated users attempting to upload files with crafted paths. Network traffic analysis tools or API access logs can be used to identify such attempts. Specific commands are not provided in the resources, but inspecting server logs for unusual upload paths or using network packet capture tools (e.g., tcpdump or Wireshark) to filter traffic to the Gitness server API endpoints may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Harness Gitness Git LFS server to version 3.3.0 or later, where the vulnerability has been patched. The fix includes strict validation of uploaded files by verifying the existence of LFS objects, checking content hashes against declared OIDs, and rejecting invalid uploads, preventing arbitrary file writes. [1, 2]