CVE-2025-22130 Soft Serve allows path traversal attacks

What is CVE-2025-22130?

CVE-2025-22130 is a medium-severity path traversal vulnerability in charmbracelet soft-serve, published on 8 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.

Weakness: CWE-22

Which versions are affected by CVE-2025-22130?

3 open source packages ship an affected version, including github.com/charmbracelet/soft-serve. It affects 1 product.

Products include Charm Soft Serve.

How do I fix CVE-2025-22130?

Upgrade github.com/charmbracelet/soft-serve to 0.8.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-22130 being exploited?

There is no known exploitation of CVE-2025-22130 in the wild and no public exploit code.

Other vulnerabilities in charmbracelet soft-serve

• CVE-2026-30832 Soft Serve: SSRF via unvalidated LFS endpoint in repo import Critical 9.1
• CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks Critical 9.1
• CVE-2026-24058 Soft Serve has Critical Authentication Bypass High 8.1
• CVE-2023-43809 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled High 7.5
• CVE-2026-33353 Soft Serve: Authenticated repo import can clone server-local private repositories High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j4jw-m6xr-fv6c, GO-2025-3374.