CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
Summary
Soft Serve is vulnerable to SSRF through its Webhooks
Original description
The description as published by the source.
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com