medium5.3
CVE-2025-68391
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload.
Impact
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| ARKETEAM | BDF | before 6.4.67 |
| ARKETEAM | PROTECTELMAJ | before 6.5.19 |