Quick answers
- Is CVE-2025-56218 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-56218 being exploited in the wild.
- How severe is CVE-2025-56218?
- Critical severity, with a CVSS score of 9.8, published 17 October 2025.
- Which products and versions are affected?
- Ascertia Signinghub <= 8.6.8.
- Is there a fix for CVE-2025-56218?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-56218 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-56218?
- Check whether you run Ascertia Signinghub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in Ascertia SigningHub v8.6.8 and earlier. The flaw is located within the file upload component, where the application fails to properly validate or sanitize uploaded files before processing. While some reports suggest the vulnerability involves social engineering via malicious links in converted PDFs, the primary critical-rated advisory indicates that an attacker can achieve remote code execution (RCE) by uploading a crafted file. The attack is reachable over the network and, according to CISA-ADP metrics, does not require prior authentication or user interaction. Users should upgrade to versions later than 8.6.8 to mitigate this risk.
Affected products
- Ascertia SigningHub <= 8.6.8
Timeline
- 2025-10-17: disclosed: Initial CVE publication
- 2025-10-17: advisory: NVD record published