CVE-2022-29180: Charm vulnerable to server-side request forgery (SSRF)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-07 · updated 2026-06-17
Weakness: CWE-918

Description

A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven't been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.

Affected products

charmbracelet charm: from 0.9.0 before 0.12.1 — fixed in 0.12.1

How to fix

Upgrade to a fixed version: charmbracelet charm 0.12.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-29180 or the next vulnerability affects your stack