Vulnerability details

CVE-2025-64522

charmbracelet soft-serve

Soft Serve is vulnerable to SSRF through its Webhooks

CVSS 3.1

9.1Critical

Official description

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`

Affected products

Vendor	Product	Versions	Source
charmbracelet	soft-serve	< 0.11.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b x_refsource_MISC
https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1 x_refsource_MISC
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-11-11
Last updated: 2025-11-12
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.36%

Probability of exploitation in 30 days

30.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-918
Server-Side Request Forgery (SSRF)