CVE-2025-58158: Harness Gitness Path Traversal Vulnerability

CVE-2025-58158 Overview

CVE-2025-58158 is an arbitrary file write vulnerability in Harness Open Source (Gitness), an end-to-end developer platform providing Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. The flaw resides in the Git Large File Storage (LFS) upload API. Improper sanitization of the upload path allows an authenticated attacker to write files to arbitrary locations on the server file system. The vulnerability maps to [CWE-22] Path Traversal and affects all Gitness versions prior to 3.3.0. Successful exploitation can lead to remote code execution and full server compromise.

Critical Impact
An authenticated user with API access can write arbitrary files anywhere on the host file system, enabling code execution and complete compromise of the Gitness server.

Affected Products

Harness Open Source (Gitness) versions prior to 3.3.0
Gitness Git LFS server component
Deployments exposing the Gitness API to authenticated users

Discovery Timeline

2025-08-29 - CVE-2025-58158 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58158

Vulnerability Analysis

The vulnerability exists in the Git LFS file upload handler in Harness Gitness. The upload endpoint accepts a path component from the client and uses it to construct the destination location on disk. Because the server does not properly sanitize or constrain this path, an attacker can include path traversal sequences such as ../ to escape the intended storage directory.

An authenticated user crafting an upload request can place attacker-controlled file content at any writable location accessible to the Gitness process. This includes overwriting application binaries, configuration files, SSH authorized keys, cron entries, or scripts loaded during pipeline execution. Any of these write primitives translate into code execution as the Gitness service account. Because Gitness commonly runs with broad privileges in CI/CD environments, attackers can pivot from a single low-privilege account into full platform compromise.

Root Cause

The Git LFS upload implementation concatenates user-supplied path data into the destination path without validating that the resulting path remains within the LFS storage root. The fix in version 3.3.0 introduces path canonicalization and boundary enforcement so that the resolved target must reside inside the designated storage directory. Technical details are available in the GitHub Security Advisory GHSA-w469-hj2f-jpr5 and the remediation commit.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the Gitness API. The attacker sends a crafted Git LFS upload request containing a manipulated object path. The server resolves the path outside of the LFS storage directory and writes the request body to that location. No user interaction is required, and exploitation complexity is low.

No verified public proof-of-concept code is available for CVE-2025-58158. See the security advisory referenced above for technical details.

Detection Methods for CVE-2025-58158

Indicators of Compromise

Git LFS upload requests containing .., encoded traversal sequences, or absolute paths in the object identifier or path parameters
Files created by the Gitness service account outside the configured LFS storage directory
Unexpected modifications to system paths such as /etc/, ~/.ssh/authorized_keys, cron directories, or Gitness binaries
New or modified executables in the Gitness working directory that do not correspond to a release artifact

Detection Strategies

Inspect Gitness HTTP access logs for LFS upload endpoints (/info/lfs/objects/) carrying path traversal patterns or unusual object identifiers
Compare on-disk file inventories against expected Gitness installation contents to identify writes outside the storage root
Monitor file integrity on sensitive system paths writable by the Gitness service user
Correlate authenticated API activity with file creation events occurring outside the LFS data directory

Monitoring Recommendations

Enable verbose request logging on the Gitness reverse proxy and forward to a centralized log store
Deploy file integrity monitoring on the host running Gitness, with alerts on writes to system directories
Audit Gitness user accounts and API tokens, flagging accounts with disproportionate LFS upload volume
Track process executions spawned by the Gitness service for indicators of post-exploitation activity

How to Mitigate CVE-2025-58158

Immediate Actions Required

Upgrade Harness Open Source (Gitness) to version 3.3.0 or later without delay
Restrict network access to the Gitness API to trusted networks and authenticated users only
Rotate API tokens, SSH keys, and credentials that may have been exposed if the server processed untrusted uploads
Review file system contents of Gitness hosts for unauthorized files written outside the LFS storage directory

Patch Information

Harness released the fix in Gitness version 3.3.0. The remediation is included in the upstream commit 21c5ce42ae13740b1cad47706c2ec85e72cc8c20. Administrators should consult the GitHub Security Advisory GHSA-w469-hj2f-jpr5 for the official advisory text.

Workarounds

If immediate patching is not possible, disable Git LFS functionality on the Gitness instance until the upgrade is applied
Place Gitness behind a reverse proxy or web application firewall that blocks LFS upload requests containing path traversal sequences
Run the Gitness service under a dedicated low-privilege user with a restrictive file system access scope and no write access to system directories
Limit Gitness API access using network controls so that only trusted developer networks can reach the LFS endpoints

bash

# Verify the running Gitness version and upgrade
docker pull harness/gitness:3.3.0
docker stop gitness && docker rm gitness
docker run -d --name gitness \
  -p 3000:3000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v gitness-data:/data \
  --user gitness \
  harness/gitness:3.3.0