PT-2026-1865 · Software Ag · Aris

CVE-2025-66838 · Publicado 2026-01-07 · Atualizado 2026-01-21

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Aris versions prior to 10.0.23.0.3587512

Description The file upload functionality does not implement rate limiting or throttling, enabling unrestricted file uploads. This allows an attacker to upload a large number of files quickly, potentially causing resource exhaustion, including disk space depletion, increased server load, and performance degradation.

Recommendations Apply a rate limit or throttling mechanism to the file upload functionality.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2025-66838

Produtos afetados

Aris

Referências · 6

• 🔥 https://github.com/saykino/CVE-2025-66838 · Exploit
• https://twitter.com/CVEnew/status/2008937803854520449 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-66838 · Nota de Segurança
• https://t.me/cveNotify/149484 · Publicação no Telegram
• https://softwareag.com · Nota
• https://osv.dev/vulnerability/CVE-2025-66838 · Aviso do Fabricante