CVE-2025-58355 — Soft Serve is vulnerable to arbitrary file writing through its SSH API

CVE-2025-58355

Soft Serve is vulnerable to arbitrary file writing through its SSH API PUBLISHED

Description (CNA)

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.

Affected (CNA)

Vendor / product	Versions
charmbracelet / soft-serve	affected < 0.10.0

CWE

CWE-22

References

https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.