CVE-2025-10760CWE-918ssrf

CVE-2025-10760

Medium · published September 21, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-21T07:15Z
References (5)
https://github.com/August829/Yu/blob/main/58ead8e7e08bfb019.md · [email protected]https://github.com/August829/Yu/blob/main/58ead8e7e08bfb019.md#poc · [email protected]https://vuldb.com/?ctiid.325115 · [email protected]https://vuldb.com/?id.325115 · [email protected]https://vuldb.com/?submit.646843 · [email protected]
EPSS history
Timeline
  • 21 SEP 02:32Z
    Harness lookup_repo.go LookupRepo server-side request forgery
    cvelistv5