Back to Database
Status published
Critical
CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
Vulnerability Description
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64522
Credits & Attribution
No credits recorded in the NVD database.
References
More from charmbracelet
View All →CVE-2025-64494
Soft Serve does not sanitize ANSI escape sequences in user input
Medium
4.6
CVE-2025-58355
Soft Serve is vulnerable to arbitrary file writing through its SSH API
High
7.7
CVE-2025-22130
Soft Serve allows path traversal attacks
Medium
5.3
CVE-2024-41956
Soft Serve allows arbitrary code execution by crafting git-lfs requests
High
8.1
CVE-2023-43809
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
High
7.5
Affected Vendor
charmbracelet
View all reports →Affected Software
soft-serve
Vulnerable Versions:
< 0.11.1
Timeline
Official Publish:
November 10th, 2025
Last Modified:
November 12th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L