CVE-2025-68391
Received Received - Intake

Arbitrary File Upload in ARKETEAM Protectel Modules

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CERT.PL

Description
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file.  This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2025-68391
EUVD
EUVD-2025-211223

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ARKETEAM PROTECTELMAJ 0
ARKETEAM BDF 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user can upload files and override existing ones in a temporary folder. This may allow execution of embedded JavaScript scripts when an authenticated user downloads the uploaded file.

Detection Guidance

Check for unauthorized file uploads in temporary folders of PROTECTELMAJ or BDF modules. Inspect web server logs for unusual file upload activities or requests to /upload endpoints. Verify file integrity by comparing hashes of uploaded files with known good versions.

Impact Analysis

An attacker could upload malicious files to the system, potentially leading to unauthorized code execution or data theft when the file is accessed. This could compromise the integrity and security of the Protectel platform and its data.

Compliance Impact

The vulnerability could undermine compliance with GDPR and other regulations by exposing sensitive data or allowing unauthorized access. Protectel is designed for regulatory compliance, so this flaw may create risks for data security and audit trails.

Mitigation Strategies

Upgrade PROTECTELMAJ to v6.5.19 and BDF to v6.4.67 immediately. Restrict file upload permissions to authenticated users only. Implement strict file type and size validation for uploads. Monitor temporary folders for suspicious files and remove any unauthorized uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68391. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart