IBM CVE-2025-66484

IBM Aspera Shares is a web-based file collaboration platform. The vulnerability resides in insufficient input sanitization on user-controllable input stored within the Web UI application layer. Stored XSS vulnerabilities (CWE-79 class) occur when user-supplied data is persisted in a backend store (database, configuration, filesystem) and later rendered in a browser without proper output encoding. This differs from reflected XSS in that the malicious payload is re-executed for any user viewing the affected content, making it persistent across sessions. The attack vector is network-based with low complexity; however, the attack requires high-privilege user roles (PR:H per CVSS vector), significantly limiting the attack surface compared to unauthenticated XSS vulnerabilities. The resulting impact includes confidentiality and integrity loss (credential disclosure, functional alteration) within the scope of the Web application.