CVE-2025-66838
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Aris version v10.0.23.0.3587512 and earlier does not enforce rate limiting or throttling in its file upload functionality, allowing users to upload files at an unrestricted rate. An attacker can exploit this to rapidly upload a large volume of files, potentially leading to resource exhaustion such as disk space depletion, increased server load, or degraded performance.
Risk Assessment
An attacker can cause resource exhaustion on the server, leading to denial of service or performance degradation. This can disrupt application operation and affect service availability.
Recommendation
Update Aris to a patched version, and until then implement rate limiting for file uploads and monitor resource usage.
Other vulnerabilities in Aris
Original NVD description (English source)
In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unrestricted rate. An attacker can exploit this behavior to rapidly upload a large volume of files, potentially leading to resource exhaustion such as disk space depletion, increased server load, or degraded performance
Vulnerability data from NVD (NIST) · CISA KEV · EPSS