CVE-2025-58355
highpriority · track · 0EPSS 0.003 · 28 %ileEUUSEPSS · scored 2026-10-28
Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-33pr-m977-5w97Soft Serve vulnerable to arbitrary file writing through SSH API2025-09-02ghsa · osvUS
Attackers can create/override arbitrary files with uncontrolled data. For a PoC, spin up an instance of soft-serve as explained in the README, and execute the following command: ```sh ssh -p23231 localhost repo commit icecream -- --output=/tmp/pwned ``` It should have created a file in `/tmp/pwned`.
- GO-2025-3930Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve2025-09-08vendor · osvUS
Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://github.com/charmbracelet/soft-serve/releasesPatchcnnvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97cnnvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97enisa_euvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan