GHSA-j4jw-m6xr-fv6c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-j4jw-m6xr-fv6c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-j4jw-m6xr-fv6c/GHSA-j4jw-m6xr-fv6c.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-j4jw-m6xr-fv6c
- Aliases
- Published
- 2025-01-08T15:43:25Z
- Modified
- 2025-01-08T20:53:34Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Soft Serve vulnerable to path traversal attacks
- Details
-
Impact
Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.
Patches
This is patched in v0.8.2
Workarounds
Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.
- Database specific
{ "nvd_published_at": "2025-01-08T16:15:38Z", "cwe_ids": [ "CWE-22" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-08T15:43:25Z" }- References
-
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-j4jw-m6xr-fv6c
- https://nvd.nist.gov/vuln/detail/CVE-2025-22130
- https://github.com/charmbracelet/soft-serve/commit/a8d1bf3f9349c138383b65079b7b8ad97fff78f4
- https://github.com/charmbracelet/soft-serve
- https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2
Affected packages
Go / github.com/charmbracelet/soft-serve
Package
- Name
- github.com/charmbracelet/soft-serve
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/charmbracelet/soft-serve