CVE-2025-10760: Harness lookup_repo.go LookupRepo server-side request forgery

Published Sep 21, 2025

Updated

A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookuprepo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Harness Harness

Event History

Sep 21, 2025

CVE Published

via MITRE·02:32 AM

Data Sourced

via MITRE·02:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-10760?

CVE-2025-10760 is considered a critical vulnerability due to its potential for server-side request forgery.

How do I fix CVE-2025-10760?

To fix CVE-2025-10760, update Harness to the latest version where the vulnerability has been patched.

What impacts does CVE-2025-10760 have on my system?

CVE-2025-10760 allows attackers to manipulate the URL argument, potentially leading to unauthorized access to your server.

Is CVE-2025-10760 remotely exploitable?

Yes, CVE-2025-10760 can be exploited remotely by an attacker targeting the vulnerable application.

Which version of Harness is affected by CVE-2025-10760?

CVE-2025-10760 affects Harness version 3.3.0.