PT-2025-46215 · Unknown · Soft Serve

Tomer-Pl · Published 2025-11-10 · Updated 2025-12-31 · CVE-2025-64522

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Soft Serve versions prior to 0.11.1

Description Soft Serve, a self-hostable Git server, contains a Server-Side Request Forgery (SSRF) issue. The application does not validate webhook URLs, which allows repository administrators to create webhooks that target internal services, private networks, and cloud metadata endpoints. This can lead to cloud metadata theft, internal network access, port scanning, data exfiltration, and internal API access. The vulnerable components include Webhook Creation (pkg/ssh/cmd/webhooks.go:125), Backend CreateWebhook (pkg/backend/webhooks.go:17), Backend UpdateWebhook (pkg/backend/webhooks.go:122), and Webhook Delivery (pkg/webhook/webhook.go:97). An example of exploitation involves creating a webhook that accesses http://127.0.0.1:8080/internal using the webhook create command.

Recommendations Versions prior to 0.11.1 should be updated to version 0.11.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-00070

CVE-2025-64522

GHSA-VWQ2-JX9Q-9H9F

GO-2025-4111

Affected Products

Soft Serve

References · 20

• 🔥 https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64522.json · Exploit
• https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b · Patch
• https://osv.dev/vulnerability/GHSA-vwq2-jx9q-9h9f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64522 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4111 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00070 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64522 · Security Note
• https://github.com/charmbracelet/soft-serve · Note
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1 · Note
• https://twitter.com/CveFindCom/status/1988029051571675608 · Twitter Post
• https://twitter.com/0dayPublishing/status/1988009971741610308 · Twitter Post
• https://twitter.com/CVEnew/status/1988012786337693883 · Twitter Post
• https://t.me/CVEtracker/36959 · Telegram Post
• https://t.me/cveNotify/147353 · Telegram Post