CVE-2025-58355 is a high-severity path traversal vulnerability (CWE-22) affecting versions 0.9.1 and below of Soft Serve, a self-hostable Git server designed for command-line use. The vulnerability arises from improper limitation of pathname inputs within the SSH API, allowing an attacker with at least limited privileges (PR:L) to create or overwrite arbitrary files on the server filesystem with attacker-controlled data. This can lead to integrity compromise of the system by replacing or injecting malicious files. The vulnerability does not impact confidentiality or availability directly but has a significant impact on integrity. Exploitation requires network access (AV:N) and privileges, but no user interaction is needed (UI:N). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the initially vulnerable component. The issue is fixed in version 0.10.0 of Soft Serve. No known exploits are currently reported in the wild, but the vulnerability’s characteristics and high CVSS score (7.7) indicate a strong potential for exploitation if left unpatched. The root cause is insufficient validation or sanitization of pathname inputs in the SSH API, allowing path traversal sequences (e.g., ../) to escape restricted directories and write files arbitrarily.

For European organizations using Soft Serve versions prior to 0.10.0, this vulnerability poses a significant risk to the integrity of their source code repositories and server environments. Attackers could overwrite critical configuration files, inject malicious code into repositories, or place backdoors on the server, potentially leading to supply chain compromises or further lateral movement within the network. Given Soft Serve’s role as a Git server, the integrity of software development workflows could be undermined, affecting software quality and trustworthiness. While confidentiality and availability impacts are limited, the ability to alter files arbitrarily can have cascading effects on operational security and compliance, especially in regulated industries such as finance, healthcare, and critical infrastructure prevalent in Europe. The lack of known exploits currently provides a window for proactive patching, but the vulnerability’s network accessibility and low complexity of exploitation make it a high-priority risk.

European organizations should immediately identify any deployments of Soft Serve versions below 0.10.0 and upgrade to version 0.10.0 or later, where the vulnerability is fixed. If immediate upgrading is not feasible, organizations should restrict SSH API access to trusted internal networks and enforce strict access controls and monitoring on the Git server. Implementing file integrity monitoring on the server filesystem can help detect unauthorized file modifications. Additionally, organizations should audit repository and server configurations for suspicious changes and review logs for anomalous SSH API usage. Employing network segmentation to isolate Git servers and applying the principle of least privilege to user accounts accessing the SSH API will reduce exploitation risk. Finally, integrating vulnerability scanning into CI/CD pipelines to detect outdated Soft Serve versions can prevent future exposure.