CVE-2025-68391: Arbitrary File Upload in Protectel
Published Oct 30, 2026
·Updated
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ARKETEAM Protectel PROTECTELMAJto a version that resolves this vulnerability.Fixed in 6.5.19 - Upgrade
Upgrade
ARKETEAM Protectel BDFto a version that resolves this vulnerability.Fixed in 6.4.67
Event History
Oct 30, 2026
CVE Published
via MITRE·11:37 AM
Data Sourced
via MITRE·11:37 AM
DescriptionWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness