CVE-2025-66908

{
  "id": "CVE-2025-66908",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-66908",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-19T15:20:56.492396Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-19T15:15:56.550",
  "references": [
    {
      "url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66908_report.md",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/turms-im/turms",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/turms-im/turms/blob/develop/turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66908_report.md",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to \"image/*\" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served."
    },
    {
      "lang": "es",
      "value": "El módulo Turms AI-Serving v0.10.0-SNAPSHOT y anteriores contiene una vulnerabilidad de validación de tipo de archivo incorrecta en la funcionalidad de carga de imágenes OCR. El OcrController en turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java utiliza la anotación @FormData(contentType = MediaTypeConst.IMAGE) para restringir las cargas a archivos de imagen, pero esta restricción no se aplica correctamente. El sistema se basa únicamente en los encabezados Content-Type proporcionados por el cliente y las extensiones de archivo sin validar el contenido real del archivo utilizando bytes mágicos (firmas de archivo). Un atacante puede cargar tipos de archivo arbitrarios, incluyendo ejecutables, scripts, HTML o web shells, configurando el encabezado Content-Type a 'image/*' o utilizando una extensión de archivo de imagen. Esta omisión permite una posible ejecución de código del lado del servidor, XSS almacenado o revelación de información, dependiendo de cómo se procesen y sirvan los archivos cargados."
    }
  ],
  "lastModified": "2026-10-05T18:10:00.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9466432E-2863-4A5B-913F-E6E64090F60B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}