Threats Tagged 'cve-2025-66908'
View all threats tagged with 'cve-2025-66908'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2025-66908'
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2025-66908 is a medium severity vulnerability in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) related to improper file type validation in the OCR image upload functionality. The system relies solely on client-supplied Content-Type headers and file extensions without verifying actual file content using magic bytes, allowing attackers to upload arbitrary file types including executables or web shells. This can lead to server-side code execution, stored cross-site scripting (XSS), or information disclosure depending on file processing and serving. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type). No known exploits are currently reported in the wild. The CVSS score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. European organizations using affected Turms AI-Serving versions should prioritize validation improvements and restrict file handling to mitigate risks. Join the discussion | CVE Database V5 | 12/19/2025, 00:00:00 UTC Added: 12/19/2025, 14:55:30 UTC |
Showing 1 to 1 of 1 result