CVE-2025-66837

The ARIS business process analysis tool by Software AG is vulnerable to a file upload flaw in version 10.0.23.0.3587512 and earlier. The vulnerability exists in the file upload API , where an attacker can upload a crafted PDF file or malware to achieve arbitrary code execution . The attack requir...

CVE-2025-66838

In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unrestricted rate. An attacker can exploit this behavior to rapidly upload a large volume of files, potentially leading to resource exhaustio...