CVE-2025-66908 Details
Description
Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to "image/*" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served.
A vulnerability exists in the Turms AI-Serving module's OCR image upload feature, specifically in versions through 0.10.0-SNAPSHOT. The OcrController improperly validates file types, allowing attackers to upload arbitrary files, including executables and scripts. This is possible because the system relies on client-supplied Content-Type headers and file extensions without checking the actual file content using magic bytes. Exploitation could lead to server-side code execution, stored cross-site scripting, or information disclosure, depending on how the uploaded files are handled.
Users are advised to update to a version of Turms AI-Serving that includes proper file type validation. If no such version is available, implement magic byte validation to check the actual content of uploaded files before processing them.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66908_report.md | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/turms-im/turms | [email protected] | Product |
| https://github.com/turms-im/turms/blob/develop/turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java | [email protected] | Product |
| https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66908_report.md | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| turms-im turms | 0.10.0-snapshot |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 2, 2026 | Initial Analysis | [email protected] |
| Dec 19, 2025 | CVE Modified | CISA-ADP |
| Dec 19, 2025 | New CVE Received | [email protected] |