charmbracelet/soft-serve · Security
Soft Serve vulnerable to arbitrary file writing through SSH API
- GHSA ID
- GHSA-33pr-m977-5w97
- CVE ID
- CVE-2025-58355
- Severity
- high
- Published
- Updated
- CVSS
- 7.7 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- CVSS v3
- 7.7 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Description
Attackers can create/override arbitrary files with uncontrolled data.
For a PoC, spin up an instance of soft-serve as explained in the README, and execute the following command:
ssh -p23231 localhost repo commit icecream -- --output=/tmp/pwned
It should have created a file in /tmp/pwned.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')