CVE-2025-67223

Published: Apr 28, 2026Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.

Related CWEs

Insecure Temporary File

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (4)

https://arandasoft.com/en/productos/aranda-service-management/

Source: cve@mitre.org

https://docs.arandasoft.com/at-v8-release-notes/en/pages/release_pdf/file_server.html

Source: cve@mitre.org

https://github.com/brandonperezlara/CVE-2025-67223

Source: cve@mitre.org

https://github.com/brandonperezlara/CVE-2025-67223

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.