CVE-2025-58158: Arbitrary File Access in Harness Gitness

The Arbitrary File Access vulnerability in Harness Gitness poses a significant threat. An attacker could leverage this flaw to upload malicious files, such as web shells, to the server. Successful exploitation could grant the attacker remote code execution capabilities, allowing them to take complete control of the Gitness instance and potentially the underlying infrastructure. The attacker could also modify critical configuration files, leading to data breaches or denial of service. The ability to write arbitrary files bypasses standard security controls, making this a particularly dangerous vulnerability.

1. Reserved2025-08-27
2. Published2025-09-17
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-58158 is to immediately upgrade to version 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13 or later. Before upgrading, it is crucial to review the release notes for any breaking changes and plan a rollback strategy if necessary. While a direct workaround isn't available, restricting file write permissions on the Gitness server can reduce the potential impact. Implement robust input validation and sanitization to prevent malicious file uploads. Monitor Gitness logs for any suspicious file creation or modification activities.