CVE-2025-22130
highpriority · track · 35EPSS 0.007 · 53 %ileDEEUUSEPSS · scored 2026-10-27
Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedgovulncheck-vulndb-0.0.20250108T191942-150000.1.26.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20250108T191942-150000.1.26.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.3–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- SUSE-SU-2025:0060-1Security update for govulncheck-vulndb2025-01-10csaf · suse_csafDE
Security update for govulncheck-vulndb
- GHSA-j4jw-m6xr-fv6cSoft Serve vulnerable to path traversal attacks2025-01-08ghsa · osvUS
### Impact Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. ### Patches This is patched in [v0.8.2](https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2) ### Workarounds Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.
- GO-2025-3374Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve2025-01-08vendor · osvUS
Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/charmbracelet/soft-serve/commit/a8d1bf3f9349c138383b65079b7b8ad97fff78f4cnnvd
- https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2cnnvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-j4jw-m6xr-fv6ccnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-22130cnnvd
- https://github.com/charmbracelet/soft-serve/commit/a8d1bf3f9349c138383b65079b7b8ad97fff78f4enisa_euvd
- https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2enisa_euvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-j4jw-m6xr-fv6cenisa_euvd
- https://github.com/charmbracelet/soft-serve/commit/a8d1bf3f9349c138383b65079b7b8ad97fff78f4Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan