CVE-2025-66837

The ARIS business process analysis tool (version 10.0.23.0.3587512 and prior) is vulnerable to a file upload flaw in its File Upload API . Attackers can execute arbitrary code by uploading a specially crafted PDF file or malware. The vulnerability occurs when a user downloads and opens the malici...

CVE-2025-66838

The Software AG ARIS business process analysis tool (versions v10.0.23.0.3587512 and before) contains a vulnerability in its file upload API . The root cause is a lack of rate limiting or throttling , which allows an attacker to upload a large volume of files at an unrestricted rate. This behavio...