PT-2026-1865 · Software Ag · Aris

Published 2026-01-07 · Updated 2026-01-21 · CVE-2025-66838

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Aris versions prior to 10.0.23.0.3587512

Description The file upload functionality does not implement rate limiting or throttling, enabling unrestricted file uploads. This allows an attacker to upload a large number of files quickly, potentially causing resource exhaustion, including disk space depletion, increased server load, and performance degradation.

Recommendations Apply a rate limit or throttling mechanism to the file upload functionality.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-66838

Affected Products

Aris

References · 6

• 🔥 https://github.com/saykino/CVE-2025-66838 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66838 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66838 · Vendor Advisory
• https://twitter.com/CVEnew/status/2008937803854520449 · Twitter Post
• https://t.me/cveNotify/149484 · Telegram Post
• https://softwareag.com · Note