x/vulndb: potential Go vuln in github.com/charmbracelet/soft-serve: GHSA-j4jw-m6xr-fv6c

[GoVulnBot]

Advisory GHSA-j4jw-m6xr-fv6c references a vulnerability in the following Go modules:

Module
github.com/charmbracelet/soft-serve

Description:

Impact

Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.

Patches

This is patched in v0.8.2

Workarounds

Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.

References:

• ADVISORY: GHSA-j4jw-m6xr-fv6c
• ADVISORY: GHSA-j4jw-m6xr-fv6c
• FIX: charmbracelet/soft-serve@a8d1bf3
• WEB: https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2

Cross references:

• github.com/charmbracelet/soft-serve appears in 2 other report(s):
  • data/reports/GO-2023-2097.yaml (x/vulndb: potential Go vuln in github.com/charmbracelet/soft-serve: GHSA-mc97-99j4-vm2v #2097)
  • data/reports/GO-2024-3019.yaml (x/vulndb: potential Go vuln in github.com/charmbracelet/soft-serve: CVE-2024-41956 #3019)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/charmbracelet/soft-serve
      versions:
        - fixed: 0.8.2
      vulnerable_at: 0.8.1
summary: Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve
cves:
    - CVE-2025-22130
ghsas:
    - GHSA-j4jw-m6xr-fv6c
references:
    - advisory: https://github.com/advisories/GHSA-j4jw-m6xr-fv6c
    - advisory: https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-j4jw-m6xr-fv6c
    - fix: https://github.com/charmbracelet/soft-serve/commit/a8d1bf3f9349c138383b65079b7b8ad97fff78f4
    - web: https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2
source:
    id: GHSA-j4jw-m6xr-fv6c
    created: 2025-01-08T16:01:25.375343783Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/641495 mentions this issue: data/reports: add 2 unreviewed reports