Vulnerability details
CVE-2025-58355
charmbracelet soft-serve
Soft Serve is vulnerable to arbitrary file writing through its SSH API
CVSS 3.1
7.7High
Official description
Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.7High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| charmbracelet | soft-serve | < 0.10.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-09-04
- Last updated
- 2025-09-04
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.34%
Probability of exploitation in 30 days
28.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')