CVE-2025-70995

An authenticated attacker can achieve remote code execution (RCE) in Aranda Service Desk Web Edition (ASDK API 8.6) due to improper validation of uploaded files. By sending a crafted POST request to the /ASDKAPI/api/v8.6/item/addfile endpoint, an attacker can upload a malicious web.config file. T...