Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qNGp3LW02eHItZnY2Y84ABDGD

Soft Serve vulnerable to path traversal attacks

Impact

Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.

Patches

This is patched in v0.8.2

Workarounds

Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.

Permalink: https://github.com/advisories/GHSA-j4jw-m6xr-fv6c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNGp3LW02eHItZnY2Y84ABDGD
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 days ago
Updated: 9 days ago

EPSS Percentage: 0.00045
EPSS Percentile: 0.17502

Identifiers: GHSA-j4jw-m6xr-fv6c, CVE-2025-22130
References:

• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-j4jw-m6xr-fv6c
• https://github.com/charmbracelet/soft-serve/commit/a8d1bf3f9349c138383b65079b7b8ad97fff78f4
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2
• https://nvd.nist.gov/vuln/detail/CVE-2025-22130
• https://github.com/advisories/GHSA-j4jw-m6xr-fv6c

Repository: https://github.com/charmbracelet/soft-serve
Blast Radius: 0.0

Affected Packages