Back to Database
Status published
Medium
CVE-2025-22130
Soft Serve allows path traversal attacks
Vulnerability Description
Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22130
Credits & Attribution
No credits recorded in the NVD database.
References
More from charmbracelet
View All →CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
Critical
9.1
CVE-2025-64494
Soft Serve does not sanitize ANSI escape sequences in user input
Medium
4.6
CVE-2025-58355
Soft Serve is vulnerable to arbitrary file writing through its SSH API
High
7.7
CVE-2024-41956
Soft Serve allows arbitrary code execution by crafting git-lfs requests
High
8.1
CVE-2023-43809
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
High
7.5
Affected Vendor
charmbracelet
View all reports →Affected Software
soft-serve
Vulnerable Versions:
< 0.8.2
Timeline
Official Publish:
January 8th, 2025
Last Modified:
January 8th, 2025
Added to House:
July 22nd, 2026