CVE-2025-58355CWE-22

Soft Serve is vulnerable to arbitrary file writing through its SSH API

High · published September 3, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-03T23:52Z
EPSS history
Timeline
  • 03 SEP 23:52Z
    Soft Serve is vulnerable to arbitrary file writing through its SSH API
    cvelistv5