CVE-2025-2706: Digiwin ERP 5.0.1 RCE Vulnerability

CVE-2025-2706 Overview

CVE-2025-2706 is an unrestricted file upload vulnerability in Digiwin ERP 5.0.1. The flaw resides in the /Api/TinyMce/UploadAjaxAPI.ashx endpoint, where the File parameter accepts attacker-controlled input without proper validation. Authenticated attackers can abuse this endpoint remotely over the network to upload arbitrary files to the server. The weakness is tracked under [CWE-284: Improper Access Control]. Public exploit information has been disclosed, increasing exposure risk. The vendor was contacted prior to disclosure but did not respond, meaning no official patch has been confirmed through the referenced advisories.

Critical Impact

Remote authenticated attackers can upload arbitrary files to the Digiwin ERP server through the TinyMce upload handler, potentially leading to code execution on the host.

Affected Products

• Digiwin ERP 5.0.1
• /Api/TinyMce/UploadAjaxAPI.ashx endpoint
• Deployments exposing the TinyMce upload API to untrusted networks

Discovery Timeline

• 2025-03-24 - CVE-2025-2706 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2706

Vulnerability Analysis

The vulnerability exists in the file upload handler UploadAjaxAPI.ashx under the /Api/TinyMce/ path. The handler accepts the File parameter without enforcing restrictions on file type, extension, or content. An attacker with low-privilege access to the application can submit a crafted multipart request to deliver executable server-side content.

Because the endpoint is reachable over the network and requires only basic authentication context, exploitation does not need user interaction. The attack can be launched remotely with low complexity. The public disclosure available in the referenced GitHub RCE Report describes exploitation leading to code execution on the host.

Successful exploitation enables an attacker to place web-executable payloads inside directories served by the ERP application. From there, the attacker can request the uploaded file through the web server to run arbitrary code in the application's security context.

Root Cause

The root cause is improper access control and missing upload validation in the TinyMce upload handler. The endpoint does not validate the file extension, MIME type, or magic bytes, and does not restrict the destination path. This maps to [CWE-284] and allows attacker-controlled content to be written to a web-accessible location.

Attack Vector

The attack vector is network-based through an HTTP POST request to the vulnerable .ashx handler. The attacker crafts a multipart form containing the File field with a server-executable payload, such as an ASP or ASPX file. Once uploaded, the attacker retrieves the resource through its web URL to trigger execution.

Technical exploitation details are documented in the public VulDB entry #300727 and the GitHub RCE Report.

Detection Methods for CVE-2025-2706

Indicators of Compromise

• POST requests to /Api/TinyMce/UploadAjaxAPI.ashx containing file uploads with executable extensions such as .aspx, .ashx, .asp, or .config.
• New or unexpected files appearing in TinyMce or ERP upload directories outside of normal business hours.
• Subsequent GET requests to uploaded files originating from external IP addresses.
• Web shell behavior such as cmd.exe or powershell.exe spawned by the ERP application worker process (w3wp.exe).

Detection Strategies

• Inspect IIS and application logs for requests targeting UploadAjaxAPI.ashx with abnormal file names, large payloads, or non-image content types.
• Deploy file integrity monitoring on the ERP web root and upload directories to flag unauthorized new files.
• Correlate upload events with child process creation from the application worker process to identify post-upload execution.

Monitoring Recommendations

• Enable detailed HTTP request logging including request body size and content type for the /Api/TinyMce/ path.
• Alert on process lineage where the ERP IIS worker process spawns command interpreters, scripting hosts, or network tools.
• Monitor outbound network connections from the ERP host to untrusted destinations following upload activity.

How to Mitigate CVE-2025-2706

Immediate Actions Required

• Restrict network access to the /Api/TinyMce/UploadAjaxAPI.ashx endpoint using firewall or reverse proxy allow-lists until a vendor fix is available.
• Review authentication requirements and remove or disable accounts that do not require upload functionality.
• Audit upload directories for unexpected files and remove any unauthorized content.
• Enforce least privilege on the IIS application pool identity to limit the impact of successful exploitation.

Patch Information

According to the referenced advisories, the vendor was contacted but did not respond, and no official patch has been published through the sources tied to CVE-2025-2706. Monitor Digiwin's official channels for updates. Until a vendor patch is available, apply the compensating controls described below.

Workarounds

• Block external access to the vulnerable endpoint at the perimeter or Web Application Firewall (WAF) layer.
• Add WAF rules that reject uploads to UploadAjaxAPI.ashx where the file extension or MIME type is not an approved image format.
• Configure IIS request filtering to deny execution of script extensions within upload directories.
• Place upload directories outside the web application root or disable script execution on those paths using web.config handler restrictions.

# Example IIS request filtering to deny execution in upload paths
# Place in web.config of the upload directory
<configuration>
  <system.webServer>
    <handlers accessPolicy="Read" />
    <security>
      <requestFiltering>
        <fileExtensions allowUnlisted="false">
          <add fileExtension=".jpg" allowed="true" />
          <add fileExtension=".png" allowed="true" />
          <add fileExtension=".gif" allowed="true" />
        </fileExtensions>
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>