CRITICAL🇵🇱 Wersja polska

CVE-2025-64522

CVSS 9.1v3.1pub. 2025-11-10upd. 2025-12-31

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

  • Charm Soft Serve

    APP
    Charm
    < 0.11.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRF
CWE
References

Related vulnerabilities

CVE-2026-30832CRITICAL9.1PL ✓ten sam produkt

SSRF w Soft Serve — dostęp do wewnętrznych usług przez LFS endpoint

CVE-2026-33353HIGH7.1ten sam produkt

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an...

CVE-2026-24058HIGH8.1ten sam produkt

Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authe...

CVE-2023-43809HIGH7.5ten sam produkt

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerabilit...

CVE-2026-22253MEDIUM5.4ten sam produkt

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypas...