CVE-2025-58158: 
vulnerability analysis and mitigation

CVE-2025-58158 is an arbitrary file write vulnerability in the Harness Open Source (Gitness) git LFS server, caused by improper sanitization of the upload path in the LFS file upload API. An authenticated attacker with low-privilege access can craft a malicious upload request to write arbitrary files to any location on the server's file system, potentially compromising the entire server. All versions prior to 3.3.0 are affected. The vulnerability was disclosed on August 29, 2025, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, ENISA EUVD).

The root cause is improper input validation and path sanitization (CWE-22: Path Traversal; CWE-73: External Control of File Name or Path) in the LFS file upload API endpoint of the Gitness server. The upload handler failed to validate that the Object ID (OID) used to construct the storage path was a legitimate SHA-256 hash, allowing a crafted OID containing path traversal sequences (e.g., ../) to resolve to arbitrary file system locations outside the intended LFS object store. The fix, introduced in commit 21c5ce4, adds SHA-256 hash verification of uploaded content against the provided OID, checks for pre-existing objects to prevent overwrites, and rejects requests where the computed hash does not match the declared OID (GitHub Commit, GitHub Advisory). Exploitation requires only a valid authenticated session with API access — no elevated privileges are needed (ENISA EUVD).

Successful exploitation allows an authenticated attacker to write arbitrary files to any location on the server's file system, enabling a wide range of follow-on attacks including remote code execution (e.g., by overwriting configuration files, cron jobs, or SSH authorized keys), privilege escalation, and full server compromise. Confidentiality, integrity, and availability are all rated High, as an attacker could exfiltrate sensitive data, corrupt or replace critical files, and render the server inoperable. All organizations using Harness Open Source (Gitness) with git LFS enabled on versions prior to 3.3.0 are at risk (GitHub Advisory, ENISA EUVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (ENISA EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, indicating a currently low probability of exploitation in the near term. The vulnerability was detected by Qualys scanners and reported by security researcher TheKavorka (GitHub Advisory). Exploitation requires authenticated access to the Gitness API, which limits the attack surface to users or compromised accounts with existing access.

1. Reconnaissance: Identify a Harness Open Source (Gitness) instance running a version prior to 3.3.0 with git LFS enabled. Confirm API accessibility and obtain or compromise a low-privilege user account with API access.
2. Authenticate: Obtain a valid API token or session credential for the Gitness server API.
3. Craft malicious LFS upload request: Construct an HTTP PUT/POST request to the LFS object upload API endpoint, supplying a crafted OID value that contains path traversal sequences (e.g., sha256:../../etc/cron.d/backdoor or similar) instead of a legitimate SHA-256 hash. Set the request body to the desired malicious file content.
4. Write arbitrary file: Submit the crafted request. Due to the lack of OID sanitization in vulnerable versions, the server constructs a file path using the attacker-controlled OID and writes the uploaded content to the resulting arbitrary location on the file system.
5. Achieve post-exploitation objective: Depending on the target path written, escalate privileges (e.g., by writing to /etc/cron.d/, SSH authorized_keys, or web shell locations), execute code, or exfiltrate sensitive data (GitHub Advisory, GitHub Commit).

• Network: Unusual HTTP PUT or POST requests to the Gitness LFS upload API endpoint containing OID values with path traversal sequences (e.g., ../, %2e%2e%2f, or non-standard SHA-256 formatted strings) in request parameters or headers.
• File System: Unexpected files appearing in directories outside the designated LFS object store (e.g., new or modified files in /etc/, /var/spool/cron/, home directories, or web-accessible paths); new SSH authorized_keys entries; unexpected cron job files.
• Logs: Gitness/Gitness API access logs showing LFS upload requests with anomalous OID values; HTTP 200 responses to LFS upload requests with non-standard OID formats; repeated upload attempts from a single authenticated user account.
• Process: Unexpected processes spawned by the Gitness service user (e.g., shells, reverse shell connections, or scheduled task execution) following LFS upload activity.

Harness has released version 3.3.0 of Harness Open Source (Gitness), which patches this vulnerability by enforcing SHA-256 hash validation of uploaded LFS content against the provided OID and rejecting requests with mismatched or malformed OIDs (GitHub Advisory, GitHub Commit). All users running versions prior to 3.3.0 should upgrade immediately. As interim mitigations, administrators should restrict API access to trusted users only, implement network-level controls to limit exposure of the Gitness API, monitor for unauthorized file write attempts, and audit existing systems for signs of compromise (ENISA EUVD).

The vulnerability was covered by SecurityOnline.info shortly after disclosure, highlighting the arbitrary file write risk in the Gitness LFS server (SecurityOnline). A community vulnerability analysis report was published on September 2, 2025, by researcher CyberDudeBivash (CyberDudeBivash Blog). The vulnerability was also included in the CISA weekly vulnerability summary bulletin for the week of August 25, 2025 (CISA Bulletin). No major vendor statements beyond the GitHub security advisory have been issued.