CVE-2025-64522

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
charmbracelet	soft-serve	< 0.11.1

References

https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3bPatch
https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1Release Notes
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9fExploit, Vendor Advisory
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9fExploit, Vendor Advisory

Timeline

Published: Nov 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-645238.8File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-645245.5cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other tha CVE-2025-645256.5Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded CVE-2025-645265.3Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-perm CVE-2025-645276.5Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authenticati CVE-2025-645285.3Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username CVE-2025-645296.5SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, CVE-2025-64534.3A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/acti CVE-2025-645307.5Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation CVE-2025-645317.8Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution CVE-2025-645379.3Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to CVE-2025-645389.3Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to