Read the docs
TI-2025-41079 Aliases CVE-2025-66908GHSA-rxfw-3x38-vmhv

Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type…

Priority MEDIUM 63CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.

Summary

Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to "image/*" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*0.10.0-snapshotVulnerableTurms-im
  • cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:* Versions 0.10.0-snapshot Vulnerable ·Turms-im

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66908
  2. 2026-10-03 Alias added: GHSA-rxfw-3x38-vmhv

References

Exploit 1

Other 2

  • TI-2025-41080 Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb… CVSS 3.1HIGH 7.5
  • TI-2025-41082 Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control… CVSS 3.1MEDIUM 6.5
  • TI-2025-41081 Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage… CVSS 3.1MEDIUM 6.0
  • TI-2025-41078 Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences