CVE-2025-66908

{"id": "CVE-2025-66908", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66908", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-19T15:20:56.492396Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-19T15:15:56.550", "references": [{"url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66908_report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms/blob/develop/turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66908_report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to \"image/*\" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served."}, {"lang": "es", "value": "El m\u00f3dulo Turms AI-Serving v0.10.0-SNAPSHOT y anteriores contiene una vulnerabilidad de validaci\u00f3n de tipo de archivo incorrecta en la funcionalidad de carga de im\u00e1genes OCR. El OcrController en turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java utiliza la anotaci\u00f3n @FormData(contentType = MediaTypeConst.IMAGE) para restringir las cargas a archivos de imagen, pero esta restricci\u00f3n no se aplica correctamente. El sistema se basa \u00fanicamente en los encabezados Content-Type proporcionados por el cliente y las extensiones de archivo sin validar el contenido real del archivo utilizando bytes m\u00e1gicos (firmas de archivo). Un atacante puede cargar tipos de archivo arbitrarios, incluyendo ejecutables, scripts, HTML o web shells, configurando el encabezado Content-Type a 'image/*' o utilizando una extensi\u00f3n de archivo de imagen. Esta omisi\u00f3n permite una posible ejecuci\u00f3n de c\u00f3digo del lado del servidor, XSS almacenado o revelaci\u00f3n de informaci\u00f3n, dependiendo de c\u00f3mo se procesen y sirvan los archivos cargados."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9466432E-2863-4A5B-913F-E6E64090F60B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}