CVE-2025-70995 - Vulnerability Analysis

Overview

Aranda Service Desk Web Edition ASDK API 8.6 contains a remote code execution caused by improper validation of uploaded files in /ASDKAPI/api/v8.6/item/addfile, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can execute arbitrary code remotely, potentially leading to full server compromise.

Mitigation

Update to the latest version with proper file validation.

References

• https://docs.arandasoft.com/asdk-api/pages/V1.9/descripcion/adjuntar_archivos.html
• https://github.com/0xcronos/CVE/blob/main/CVE-2025-70995/README.md

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2025-70995 - High (8.8) An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafte... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70995/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/0xcronos/CVE

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner