CVE-2025-22130

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without...

CVE-2025-22130 Soft Serve allows path traversal attacks

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without...

CVE-2025-22130 Soft Serve allows path traversal attacks

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without...

CVE-2025-22130

CVE-2025-22130 affects the Soft Serve Git server. Prior to version 0.8.2, a path traversal vulnerability lets existing non-admin users access and take over other users’ repositories, enabling modification, deletion, and arbitrary admin-like actions on repositories without explicit permissions. Th...

Soft Serve 路径遍历漏洞

Soft Serve is a self-hostable command-line Git server from Charm Open Source. A path traversal vulnerability exists in Soft Serve versions prior to 0.8.2, which stems from vulnerability to a path traversal attack that allows an existing non-administrative user to access and take over another user...

The vulnerability of Git servers in Soft Serve mode arises from the lack of measures to neutralize special elements used in the operating system’s command line. This allows attackers to execute arbitrary code.

The vulnerability of the Git server in Soft Serve relates to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially created malware file through t...

GO-2023-2097 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve

Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve...

FreeBSD : soft-serve -- Remote code execution vulnerability (8c342a6c-563f-11ef-a77e-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8c342a6c-563f-11ef-a77e-901b0e9408dc advisory. soft-serve team reports: Arbitrary code execution by crafting git ssh requests It is possible for a use...

GO-2024-3019 soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve...

GHSA-M445-W3XR-VP2F soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

Impact Any servers using soft-serve server and git Patches 0.7.5 Workarounds None. References n/a. --- It is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all...

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

Impact Any servers using soft-serve server and git Patches 0.7.5 Workarounds None. References n/a. --- It is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all...

CVE-2024-41956

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by...

CVE-2024-41956

The CVE-2024-41956 issue affects Soft Serve (a self-hostable Git server). It allows an attacker who can commit to a repository to execute arbitrary code by abusing environment variables passed to git subprocesses (notably LD_PRELOAD). This is possible because the server forwards client-provided e...

Soft Serve 安全漏洞

Soft Serve is a self-hostable command-line Git server from Charm Open Source. A security vulnerability exists in Soft Serve versions prior to 0.7.5 that stems from improper handling of environment variables. Users could execute arbitrary code via environment manipulation and Git while committing...

soft-serve -- Remote code execution vulnerability

soft-serve team reports: Arbitrary code execution by crafting git ssh requests It is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git...

PT-2024-6167 · Unknown +2 · Soft Serve +2

Name of the Vulnerable Software and Affected Versions: Soft Serve versions prior to 0.7.5 Description: The issue is related to Soft Serve passing all environment variables given by the client to git subprocesses, including variables that control program execution, such as LD PRELOAD. This can be...

The vulnerability of Git servers in Soft Serve mode, related to the absence of authentication procedures, allows attackers to bypass the authentication process.

The vulnerability of Git servers in Soft Serve mode is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass the authentication process...