Turms AI-Serving CVE-2025-66908

Exploitation requires reaching the OCR image-upload endpoint exposed by the Turms AI-Serving module's OcrController, which relies on the @FormData(contentType = MediaTypeConst.IMAGE) annotation that is not actually enforced; the attacker simply sets the Content-Type header to 'image/*' or uses an image file extension to bypass the check. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N). The key LIMITING factors are: only Turms AI-Serving v0.10.0-SNAPSHOT and earlier are affected (a pre-release snapshot, not a GA build); the AI-Serving module with the OCR upload feature must be deployed and network-reachable; and the elevated outcomes (server-side code execution, stored XSS) are NOT guaranteed by the upload itself - they depend on whether the application subsequently executes the upload directory or serves the stored file back to users, so a deployment that never serves or executes uploaded content faces only the storage of arbitrary files.

This is a moderate-severity file-upload validation flaw (CWE-434) whose signals point to a real but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial remote, unauthenticated, low-complexity exploitation, but the NVD base score is only 5.3 because impact is scoped conservatively to C:L/I:N/A:N - a notable tension with the description's claim of 'potential server-side code execution, stored XSS, or information disclosure.' Those higher impacts are explicitly conditional ('depending on how uploaded files are processed and served'), so the description's worst-case framing is NOT reflected in the rated impact metrics - treat RCE/XSS as unconfirmed potential, not demonstrated. Exploitation status: publicly available exploit code exists (a third-party CVE report on GitHub), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation. No SSVC decision data was supplied. The dominant risk-reducing factor is prevalence: Turms is a niche open-source instant-messaging engine, affected only at v0.10.0-SNAPSHOT (a pre-release development snapshot), which sharply limits real-world exposure. Net assessment: a legitimate, easily triggered input-validation bug worth patching in any Turms deployment, but a low operational priority for most organizations given the narrow footprint, conditional impact, and absence of active-exploitation signals.

A remote, unauthenticated attacker sends a crafted multipart upload to the Turms AI-Serving OCR endpoint, setting the Content-Type header to 'image/*' or appending an image file extension while the body actually contains a web shell, HTML, or script. Because the @FormData image constraint trusts the client-supplied Content-Type and extension rather than validating magic bytes, the non-image file is accepted and stored. A public exploit report exists; realized impact (code execution, stored XSS, or info disclosure) depends on whether and how the uploaded file is later served or processed.