File Injection Vulnerability in Soft Serve Git Server
CVE-2025-58355

7.7HIGH

Key Information:

Vendor

Charmbracelet

Status
Soft-serve
Vendor
CVE Published:
3 September 2025

What is CVE-2025-58355?

An issue exists in Soft Serve, a self-hostable Git server, where versions 0.9.1 and earlier are susceptible to file injection attacks via the SSH API. Attackers can exploit this flaw to create or overwrite arbitrary files using uncontrolled data, potentially compromising server integrity. This vulnerability has been addressed in version 0.10.0, which is recommended for enhanced security.

Affected Version(s)

soft-serve < 0.10.0

References

https://github.com/charmbracelet/soft-serve/security/advi...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.