CVE-2025-22130: Soft Serve allows path traversal attacks
Impact
Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.
Patches
This is patched in v0.8.2
Workarounds
Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.
Other sources
Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22130?
CVE-2025-22130 has a high severity due to its potential for unauthorized access to user repositories.
How do I fix CVE-2025-22130?
To fix CVE-2025-22130, upgrade the affected software to version 0.8.2 or later.
What type of attack does CVE-2025-22130 involve?
CVE-2025-22130 involves a path traversal attack that allows unauthorized access to user repositories.
Who is affected by CVE-2025-22130?
Non-admin users are affected by CVE-2025-22130 as it allows them to access and manipulate other users' repositories.
What could a malicious user do with CVE-2025-22130?
A malicious user could modify, delete, or take over other user's repositories as if they were an admin.