https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:27:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277344 EUVD-2026-277344 https://cve.radiocsirt.org/vuln/euvd-2026-277344 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33353 <p>Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user&#39;s private repo, into a new repository they control. This issue has been patched in version 0.11.6.</p> <p>Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user&#39;s private repo, into a new repository they control. This issue has been patched in version 0.11.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33353 https://cve.radiocsirt.org/vuln/ghsa-xgxp-f695-6vrp <p><strong>Affected:</strong> Go: github.com/charmbracelet/soft-serve</p> <p>### Summary An authorization flaw in `repo import` allows any authenticated SSH user to clone a server-local Git repository, including another user&#39;s private repo, into a new repository they control. This breaks the private-repository confidentiality boundary and should be treated as High severity.</p> <p>### Details Repo import checks authorization only for the destination repository name, not for the source remote. The destination-side authorization comes from [`pkg/ssh/cmd/cmd.go:172`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/cmd.go#L172), which calls [`pkg/backend/user.go:46`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L46). If the destination repo does not already exist, any authenticated user is granted `ReadWriteAccess` at [`pkg/backend/user.go:94`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L94).</p> <p>The import command then passes the user-controlled `REMOTE` into [`pkg/backend/repo.go:102`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/repo.go#L102). In vulnerable `HEAD`, `git.Clone(remote, rp, copts)` is reached without validating that `remote` is actually a network remote. As a result, a user can supply a server filesystem path such as `$DATA_PATH/repos/secret.git` and cause the server to clone its own local bare repository into a new repo owned by the attacker.</p> <p>The relevant vulnerable flow is: - [`pkg/ssh/cmd/import.go`](https://github.com/charmbracelet/soft-serve/b…</p> <p><strong>Affected:</strong> Go: github.com/charmbracelet/soft-serve</p> <p>### Summary An authorization flaw in `repo import` allows any authenticated SSH user to clone a server-local Git repository, including another user&#39;s private repo, into a new repository they control. This breaks the private-repository confidentiality boundary and should be treated as High severity.</p> <p>### Details Repo import checks authorization only for the destination repository name, not for the source remote. The destination-side authorization comes from [`pkg/ssh/cmd/cmd.go:172`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/cmd.go#L172), which calls [`pkg/backend/user.go:46`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L46). If the destination repo does not already exist, any authenticated user is granted `ReadWriteAccess` at [`pkg/backend/user.go:94`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L94).</p> <p>The import command then passes the user-controlled `REMOTE` into [`pkg/backend/repo.go:102`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/repo.go#L102). In vulnerable `HEAD`, `git.Clone(remote, rp, copts)` is reached without validating that `remote` is actually a network remote. As a result, a user can supply a server filesystem path such as `$DATA_PATH/repos/secret.git` and cause the server to clone its own local bare repository into a new repo owned by the attacker.</p> <p>The relevant vulnerable flow is: - [`pkg/ssh/cmd/import.go`](https://github.com/charmbracelet/soft-serve/b…</p> https://cve.radiocsirt.org/vuln/ghsa-xgxp-f695-6vrp