CVE-2025-56218
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Risk Assessment
The risk for the organization includes potential system compromise, data theft, or service disruption.
Recommendation
It is recommended to immediately update SigningHub to the latest version and implement file upload validation mechanisms.
Other vulnerabilities in SigningHub
See all- CVE-2025-56224High
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
- CVE-2025-56223High
Lack of rate limiting in the /Home/UploadStreamDocument component of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) by uploading an excessive number of files.
- CVE-2025-56219High
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without rate limiting, leading to resource exhaustion and Denial of Service (DoS).
Original NVD description (English source)
An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS