GHSA-j4jw-m6xr-fv6c

Suggest an improvement
Source
https://github.com/advisories/GHSA-j4jw-m6xr-fv6c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-j4jw-m6xr-fv6c/GHSA-j4jw-m6xr-fv6c.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-j4jw-m6xr-fv6c
Aliases
Published
2025-01-08T15:43:25Z
Modified
2025-01-08T20:53:34Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Soft Serve vulnerable to path traversal attacks
Details

Impact

Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.

Patches

This is patched in v0.8.2

Workarounds

Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.

Database specific
{
    "nvd_published_at": "2025-01-08T16:15:38Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-08T15:43:25Z"
}
References

Affected packages

Go / github.com/charmbracelet/soft-serve

Package

Name
github.com/charmbracelet/soft-serve
View open source insights on deps.dev
Purl
pkg:golang/github.com/charmbracelet/soft-serve

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.8.2