Arbitrary File Upload Vulnerability in ARKETEAM Protectel Modules
CVE-2025-68391

5.3MEDIUM

Key Information:

Vendor

Arketeam

Status
Protectelmaj
Bdf
Vendor
CVE Published:
30 October 2026

What is CVE-2025-68391?

The ARKETEAM Protectel modules, specifically PROTECTELMAJ and BDF, are susceptible to a significant vulnerability that allows arbitrary file uploads. This flaw enables any user to upload files of their choosing, which can overwrite existing files within a temporary directory. Should an authenticated user then attempt to download these files, it opens the door to the execution of malicious JavaScript embedded in the uploaded content, potentially leading to serious security breaches. The vulnerability has been addressed in the latest versions: PROTECTELMAJ v6.5.19 and BDF v6.4.67.

Affected Version(s)

BDF 0 < 6.4.67

PROTECTELMAJ 0 < 6.5.19

References

https://protectel.arketeam.com/
product
https://cert.pl/en/posts/2026/10/CVE-2025-68391/
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karol Miring
.