CVE-2026-30832

Katalog CVE

CVSS 9.1 · Critical EPSS 0,41%

Kerentanan Server-Side Request Forgery (SSRF) pada charm soft serve. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.

Rincian

Terbit di NVD

7 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv exploit · mitigasi · advisory vendor
• https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4e patch
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4 product · release notes