CVE-2025-1068: There is a code injection vulnerability in Esri ArcGIS AllSource
There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS AllSource, the file could execute and run malicious commands under the context of the victim. This issue is corrected in ArcGIS AllSource 1.2.1 and 1.3.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1068?
CVE-2025-1068 is considered a high severity vulnerability due to the potential for exploitation by low privileged attackers.
How do I fix CVE-2025-1068?
To mitigate CVE-2025-1068, it is recommended to upgrade to a patched version of Esri ArcGIS AllSource that addresses this vulnerability.
Who is affected by CVE-2025-1068?
CVE-2025-1068 affects users of Esri ArcGIS AllSource versions 1.2 and 1.3.
What kind of attack is possible with CVE-2025-1068?
CVE-2025-1068 allows an attacker to introduce a malicious executable into the filesystem due to the untrusted search path in the application.
Can CVE-2025-1068 be exploited remotely?
CVE-2025-1068 typically requires local file system write privileges, limiting the ability to exploit it remotely.