CVE-2025-66908 File upload in n/a
Attackers can upload malicious files by bypassing image validation, potentially leading to server-side code execution or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66908?
CVE-2025-66908 is a medium-severity vulnerability in n/a, published on 19 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to "image/*" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served.
Weakness: CWE-434
Which versions are affected by CVE-2025-66908?
It affects 1 product.
Products include Turms-Im Turms.
How do I fix CVE-2025-66908?
No fix has been published for CVE-2025-66908 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-66908 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66908 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rxfw-3x38-vmhv.