CVE-2025-67223

CVE-2025-67223: Incorrect Access Control & Information Disclosure in Aranda Service Desk CVE ID: CVE-2025-67223 Affected Product: Aranda Service Desk Aranda File Server - AFS module Affected Versions: 8.3.12 Author: Brandon Perez Lara 🚨 Overview A critical vulnerability was identified in the file...

Aranda Service Desk 安全漏洞

Aranda Service Desk is an IT service management and helpdesk system provided by the American company Aranda. Versions of Aranda Service Desk prior to 8.3.12 contained security vulnerabilities. These vulnerabilities stemmed from the Aranda File Server component storing daily activity logs in a...

CVE-2025-67223: Insecure Temporary File

The Aranda File Server AFS component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls...

CVE-2025-67223

The Aranda File Server AFS component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls...

CVE-2025-67223

The Aranda File Server AFS component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls...

CVE-2025-67223

The Aranda File Server (AFS) component in Aranda Service Desk before version 8.3.12 is vulnerable to Incorrect Access Control and Information Disclosure . The software stores daily activity logs with predictable names (e.g., YYYYMMDD.log) in a publicly accessible directory (/AFS/logs/) without re...

CVE-2025-70995

An issue in Aranda Service Desk Web Edition ASDK API 8.6 allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile,...

EUVD-2025-208329

An issue in Aranda Service Desk Web Edition ASDK API 8.6 allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile,...

CVE-2025-70995

An issue in Aranda Service Desk Web Edition ASDK API 8.6 allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile,...

CVE-2025-70995

An issue in Aranda Service Desk Web Edition ASDK API 8.6 allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile,...

CVE-2025-70995: Improper Control of Generation of Code

An issue in Aranda Service Desk Web Edition ASDK API 8.6 allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile,...

CVE-2025-70995

An issue in Aranda Service Desk Web Edition ASDK API 8.6 allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile,...

CVE-2025-70995

An authenticated attacker can achieve remote code execution (RCE) in Aranda Service Desk Web Edition (ASDK API 8.6) due to improper validation of uploaded files. By sending a crafted POST request to the /ASDKAPI/api/v8.6/item/addfile endpoint, an attacker can upload a malicious web.config file. T...

PT-2026-23513

Name of the Vulnerable Software and Affected Versions Aranda Service Desk Web Edition ASDK API version 8.6 Description An issue allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file ...

Aranda Service Desk Web Edition 安全漏洞

Aranda Service Desk Web Edition is a process management support system developed by the American company Aranda. There is a security vulnerability in Aranda Service Desk Web Edition, which stems from improper validation of uploaded files, potentially allowing remote code execution...

CVE-2025-70995

An issue in Aranda Service Desk Web Edition ASDK API 8.6 allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile,...