PT-2025-52451 · Unknown · Turms Ai-Serving

Xzzz111 · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-66908

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Turms AI-Serving module versions prior to 0.10.0-SNAPSHOT

Description The software has an issue with how it handles file uploads in the OCR image upload functionality. The system does not properly check the actual content of uploaded files, relying only on the file extension and Content-Type header provided by the client. This allows an attacker to upload malicious files, such as executables or scripts, disguised as images by setting the Content-Type header to "image/*". The OcrController class, specifically in the file turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java, uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation, which is insufficient for proper validation. This bypass could lead to server-side code execution, stored cross-site scripting (XSS), or information disclosure, depending on how the uploaded files are handled.

Recommendations Versions prior to 0.10.0-SNAPSHOT should be updated.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-66908

Affected Products

Turms Ai-Serving

References · 6

• 🔥 https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66908_report.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66908 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66908 · Vendor Advisory
• https://github.com/turms-im/turms · Note
• https://github.com/turms-im/turms/blob/develop/turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java · Note
• https://twitter.com/CVEnew/status/2002099209936458201 · Twitter Post