CVE-2025-64522 Details
Description
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
A server-side request forgery (SSRF) vulnerability has been identified in Soft Serve, a self-hostable Git server, in versions prior to 0.11.1. The vulnerability arises because webhook URLs are not properly validated, allowing repository administrators to create webhooks that target internal services, private networks, and cloud metadata endpoints. This could lead to unauthorized access to sensitive information or services.
Users can update to Soft Serve version 0.11.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| charm soft serve | < 0.11.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 31, 2025 | Initial Analysis | [email protected] |
| Nov 12, 2025 | CVE Modified | CISA-ADP |
| Nov 10, 2025 | New CVE Received | [email protected] |