Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.

Affected: Go: github.com/charmbracelet/soft-serve

### Impact

Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.

### Patches

This is patched in [v0.8.2](https://github.com/charmbracelet/soft-serve/releases/tag/v0.8.2)

### Workarounds

Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.

govulncheck-vulndb-0.0.20250108T191942-1.1 on GA media

Security update for govulncheck-vulndb