Back to Database
Status published
High
CVE-2025-58355
Soft Serve is vulnerable to arbitrary file writing through its SSH API
Vulnerability Description
Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-58355
Credits & Attribution
No credits recorded in the NVD database.
More from charmbracelet
View All →CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
Critical
9.1
CVE-2025-64494
Soft Serve does not sanitize ANSI escape sequences in user input
Medium
4.6
CVE-2025-22130
Soft Serve allows path traversal attacks
Medium
5.3
CVE-2024-41956
Soft Serve allows arbitrary code execution by crafting git-lfs requests
High
8.1
CVE-2023-43809
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
High
7.5
Affected Vendor
charmbracelet
View all reports →Affected Software
soft-serve
Vulnerable Versions:
< 0.10.0
Timeline
Official Publish:
September 3rd, 2025
Last Modified:
September 4th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N