CVE-2025-66837
File Upload Vulnerability in ARIS 10.0 Enables Remote Code Execution
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| software_ag | aris | to 10.0.23.0.3587512 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a file upload flaw in the ARIS software (version 10.0.23.0.3587512 and earlier) that allows authenticated remote attackers to upload a specially crafted PDF file containing malicious code. When a user downloads and opens this malicious PDF, arbitrary code can be executed on their system, potentially compromising it. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to arbitrary code execution on your system when a malicious PDF file is uploaded and then opened by a user. This can result in unauthorized control over the affected system, data compromise, or further malware infection. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for uploads of crafted PDF files to the ARIS File Upload API. You can inspect web server logs or application logs for suspicious PDF upload activity. Additionally, scanning uploaded PDF files for known malicious payloads using antivirus or malware detection tools is recommended. Specific commands depend on your environment, but for example, using grep to find PDF uploads in logs: `grep ".pdf" /path/to/logfile` or using file scanning tools like `clamscan` on uploaded files. Network monitoring tools can also be configured to alert on unusual file uploads to the ARIS application. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading ARIS to a version later than 10.0.23.0.3587512 where the vulnerability is fixed. Additionally, implement strict validation of uploaded files to ensure they do not contain malicious payloads, especially crafted PDF files. Restrict file upload permissions and monitor upload activity closely. Applying web application firewalls (WAF) rules to block suspicious file uploads can also help reduce risk. [1]