CVE-2025-58355 HIGH

CVE-2025-58355: Soft Serve is vulnerable to arbitrary file writing through its SSH API

Vendor Charmbracelet
Product soft-serve
Weakness CWE-22 · Path traversal
Published September 3, 2025
Last update September 4, 2025
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.

Key dates

02Disclosure timeline

September 3, 2025 CVE published
September 4, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-39473 WordPress Seofy Core plugin <= 1.6.8 - Local File Inclusion Vulnerability CVE-2025-13791 Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal CVE-2024-36418 SuiteCRM authenticated RCE using connectors CVE-2024-2210 The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing CVE-2026-4858 Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.