PT-2026-26490 · Unknown · Soft Serve
Evnsh
·
Publicado
2026-03-19
·
Atualizado
2026-03-27
·
CVE-2026-33353
CVSS v4.0
7.1
Alta
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Soft Serve versions prior to 0.11.6
Description
An authorization flaw exists in the
repo import functionality, allowing any authenticated SSH user to clone server-local Git repositories, including private repositories belonging to other users, into new repositories they control. This bypasses the intended confidentiality boundaries for private repositories. The issue stems from insufficient validation of the source remote during the import process. Specifically, the authorization check only verifies the destination repository name, not the source remote. The vulnerable code flow involves the pkg/ssh/cmd/import.go, pkg/ssh/cmd/cmd.go, pkg/backend/user.go, and pkg/backend/repo.go files. The git.Clone() function is called without verifying that the remote parameter is a network remote, enabling an attacker to supply a server filesystem path. This allows unauthorized access to and duplication of private repositories.Recommendations
Upgrade to version 0.11.6 or later to address this issue.
Exploit
Correção
Missing Authorization
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Soft Serve