CVE-2025-22130
📋 TL;DR
CVE-2025-22130 is a path traversal vulnerability in Soft Serve Git server that allows non-admin users to access and take over other users' repositories. Attackers can modify, delete, and control repositories as if they were admin users without proper permissions. This affects all Soft Serve instances running versions prior to 0.8.2.
💻 Affected Systems
- Soft Serve
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all repositories, including deletion, modification, and unauthorized administrative control over the entire Git server instance.
Likely Case
Unauthorized access to sensitive repositories, data theft, code manipulation, and potential supply chain attacks through repository modifications.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized users from reaching vulnerable instances.
🎯 Exploit Status
Exploitation requires an existing user account but no special privileges. The path traversal technique is well-documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.2
Vendor Advisory: https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-j4jw-m6xr-fv6c
Restart Required: No
Instructions:
1. Stop the Soft Serve service. 2. Update to version 0.8.2 or later using your package manager or by downloading from GitHub releases. 3. Restart the service.
🔧 Temporary Workarounds
Restrict User Access
allTemporarily restrict access to only trusted users until patching can be completed.
# Review and remove untrusted users from Soft Serve configuration
# Consider disabling user registration temporarily
🧯 If You Can't Patch
- Implement strict network access controls to limit which users can reach the Soft Serve instance
- Enable detailed audit logging and monitor for unusual repository access patterns
🔍 How to Verify
Check if Vulnerable:
Check Soft Serve version. If version is less than 0.8.2, the system is vulnerable.Check Version:
soft-serve --versionVerify Fix Applied:
Confirm version is 0.8.2 or higher and test that users cannot access repositories outside their permissions.📡 Detection & Monitoring
Log Indicators:
- Unusual repository access patterns
- Users accessing repositories they don't own
- Failed path traversal attempts in logs
Network Indicators:
- Unusual Git operations from non-admin users
- Multiple repository access attempts from single user
SIEM Query:
source="soft-serve" AND (event="repository_access" OR event="git_operation") AND user!="admin" AND repository NOT IN user_repositories