VulnerabilityDeferred

CVE-2025-58355

In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API.

HIGH 7.7EPSS 0.34%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: security-advisories@github.com

References

https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.