Soft Serve vulnerable to path traversal attacks
Date: 2025-01
Affected: go/github.com/charmbracelet/soft-serve
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-22130
CWE: CWE-22

### Impact Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. ### Patches This is patched in [v0.8.2](https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2) ### Workarounds Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.


Mitigations:

Architectural layers (MAESTRO):