Vulnerability · Published Oct 30, 2026 · Assigned by CERT-PL

CVE-2025-68391Arbitrary File Upload in Protectel

Medium 5.3

In plain English

A medium-severity unrestricted file upload in BDF from ARKETEAM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.2%top 85.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

Affected products (as reported)

Vendor	Product	Versions
ARKETEAM	PROTECTELMAJ	0 – before 6.5.19
ARKETEAM	BDF	0 – before 6.4.67

Weakness: CWE-434 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://protectel.arketeam.com/ product
https://cert.pl/en/posts/2026/10/CVE-2025-68391/ third-party-advisory