PT-2026-35739 · Undefined · Undefined

Published 2026-04-28 · Updated 2026-04-28 · CVE-2025-67223

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-377

CWE-532

Related Identifiers

CVE-2025-67223

Affected Products

Undefined

References · 4

• 🔥 https://github.com/brandonperezlara/CVE-2025-67223 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67223 · Security Note
• https://arandasoft.com/en/productos/aranda-service-management · Note
• https://docs.arandasoft.com/at-v8-release-notes/en/pages/release_pdf/file_server.html · Note