CVE-2025-67223 Details

A vulnerability in the Aranda File Server component of Aranda Service Desk, affecting versions prior to 8.3.12, allows unauthenticated remote attackers to access daily activity logs stored in a publicly accessible directory. These logs, named with predictable formats, can be exploited to obtain direct virtual paths of uploaded files, bypassing access controls and enabling the download of sensitive documents containing personally identifiable information (PII).

Users are advised to update Aranda Service Desk to version 8.3.12 or higher. Additionally, access to the logs should be restricted by moving them outside the web root, enforcing mandatory session validation for accessing service call and incident directories, and disabling directory listing on the IIS web server.