What’s Vulnerable › Vulnerabilities

CVE-2025-58355: Soft Serve is vulnerable to arbitrary file writing through its SSH API

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-04 · updated 2026-06-17
• Weakness: CWE-22

Description

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.

Affected products

• charmbracelet soft-serve: before 0.10.0

References

• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97

Get alerted when CVE-2025-58355 or the next vulnerability affects your stack