High severity7.7OSV Advisory· Published Sep 4, 2025· Updated Apr 15, 2026

CVE-2025-58355

Description

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/charmbracelet/soft-serveGo	< 0.10.0	0.10.0

Affected products

Charmbracelet/Soft ServeOSV
Range: v0.1.0, v0.1.1, v0.1.2, …
ghsa-coords4 versions
pkg:golang/github.com/charmbracelet/soft-serve pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed pkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6
< 0.10.0+ 3 more
- (no CPE)range: < 0.10.0
- (no CPE)range: < 0.0.20250918T182144-150000.1.107.1
- (no CPE)range: < 0.0.20250908T141310-1.1
- (no CPE)range: < 0.0.20250918T182144-150000.1.107.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-33pr-m977-5w97ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-58355ghsaADVISORY
github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000