CVE-2025-70995

CVE-2025-70995 is a remote code execution vulnerability in Aranda Service Desk Web Edition, specifically the ASDK API 8.6 component, stemming from improper validation of uploaded files. Authenticated attackers can upload a crafted web.config file via a POST request to the /ASDKAPI/api/v8.6/item/addfile endpoint. This file is processed by the ASP.NET runtime, which alters the execution context of the upload directory, allowing compilation and execution of attacker-controlled code, such as an .aspx webshell. The vulnerability affects both On-Premise and SaaS deployments of Aranda Service Desk and has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-94 (Improper Control of Generation of Code).

An authenticated user with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required beyond initial authentication. By uploading the malicious web.config and subsequent code files, the attacker achieves arbitrary remote command execution on the server, potentially leading to full compromise including data exfiltration, persistence, or lateral movement.

The vendor has addressed the issue in Aranda Service Desk V8 8.30.6, as detailed in the release notes. Additional documentation on file attachment functionality is available in the ASDK API docs, and a proof-of-concept is described in a GitHub repository. Security practitioners should apply the patch promptly and review access controls for authenticated API endpoints.