High severity7.5NVD Advisory· Published Apr 28, 2026· Updated Apr 28, 2026

CVE-2025-67223

Description

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Aranda Software/Aranda Service Deskllm-create
Range: <8.3.12
Aranda Software/Aranda File Serverllm-create
Range: <8.3.12

Patches

Vulnerability mechanics

References

arandasoft.com/en/productos/aranda-service-management/nvd
docs.arandasoft.com/at-v8-release-notes/en/pages/release_pdf/file_server.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000