Soft Serve allows path traversal attacks
Priority LOW 25CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00698 53rd percentileScored 2026-11-07
Fix Fixed soft-serve (charmbracelet): 0.8.2github.com/charmbracelet/soft-serve (Go): 0.8.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| charmbracelet | soft-serve | before 0.8.2 | 0.8.2 | Patch available | CNA |
| — | github.com/charmbracelet/soft-serve (Go) | before 0.8.2 | 0.8.2 | Patch available | GHSA-j4jw-m6xr-fv6c |
- soft-serve Vendorcharmbracelet Affected before 0.8.2 Fixed in 0.8.2 Patch available CNA
- github.com/charmbracelet/soft-serve (Go) Vendor— Affected before 0.8.2 Fixed in 0.8.2 Patch available GHSA-j4jw-m6xr-fv6c
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:* | before 0.8.2 | Vulnerable | charmbracelet |
- cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:* Versions before 0.8.2 Vulnerable ·charmbracelet
Remediation
- Fix · CNA soft-serve (charmbracelet) Fixed in 0.8.2
- Fix · GHSA-j4jw-m6xr-fv6c github.com/charmbracelet/soft-serve (Go) Fixed in 0.8.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-22130
- 2026-10-03 Alias added: GHSA-j4jw-m6xr-fv6c
References
Patch 2
More charmbracelet Soft Serve vulnerabilities
- TI-2026-23661 Soft Serve: SSRF via unvalidated LFS endpoint in repo import CVSS 3.1CRITICAL 9.1
- TI-2025-39912 Soft Serve is vulnerable to SSRF through its Webhooks CVSS 3.1CRITICAL 9.1
- TI-2023-23497 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVSS 3.1HIGH 7.5
- TI-2026-25759 Soft Serve: Authenticated repo import can clone server-local private repositories CVSS 4.0HIGH 7.1
- TI-2026-17863 Soft Serve is missing an authorization check in LFS lock deletion CVSS 3.1MEDIUM 5.4
- TI-2026-19385 Soft Serve has Critical Authentication Bypass CVSS 4.0HIGH 8.1
Sources
- CVE-2025-22130 · CVE Program
- CVE-2025-22130 · NVD
- FIRST EPSS
- GHSA-j4jw-m6xr-fv6c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences