CVE-2025-58158 Flaw in Harness Gitness Allows Arbitrary File Write

CVE-2025-58158 describes a critical flaw in Harness Open Source Gitness that exposes the Git LFS server to arbitrary file write attacks, with a CVSS score of 8.8. The vulnerability stems from improper sanitisation of upload paths in the file upload API for Git LFS, allowing an authenticated attacker to craft requests that write files anywhere on the server’s filesystem.

Harness Gitness combines code hosting, automated pipelines, Gitspaces and artifact registries, and the flaw could enable server compromise, privilege escalation and supply chain risks by tampering with binaries, configuration files or build artifacts. According to the advisory, “Open Source Harness git LFS server (Gitness) exposes API to retrieve and upload files via git LFS.

Implementation of upload git LFS file API is vulnerable to arbitrary file write.” The affected versions are all prior to v3.3.0, and Harness has released a patched version v3.3.0 to mitigate the issue, with Git LFS users urged to upgrade. 2 September 2025.