CVE-2025-58355: Arbitrary File Access in Soft Serve

The Arbitrary File Access vulnerability in Soft Serve poses a significant risk. An attacker exploiting this flaw can write malicious files to the server's filesystem, potentially overwriting critical configuration files or injecting malicious code. Successful exploitation could lead to remote code execution (RCE), allowing the attacker to gain complete control over the affected system. The impact is amplified if the server hosts sensitive data or is part of a critical infrastructure. The ability to write arbitrary files bypasses standard security controls, making it a particularly dangerous vulnerability.

1. Reserved2025-08-29
2. Published2025-09-08
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-58355 is to upgrade to version 0.10.0 or later of Soft Serve. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict access to the SSH API to trusted users and networks. Implement strict file access controls on the server to limit the attacker's ability to write files to sensitive locations. Monitor SSH logs for suspicious activity, particularly attempts to access or modify files outside of expected directories. After upgrading, confirm the fix by attempting to trigger the file writing vulnerability and verifying that it is no longer exploitable.