CVE-2025-68391

UNKNOWN 0.0

Arbitrary File Upload in Protectel

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

CWE	CWE-434
Vendor	arketeam
Product	protectelmaj
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for arketeam protectelmaj

Be the first to know when new unknown vulnerabilities affecting arketeam protectelmaj are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

ARKETEAM / PROTECTELMAJ

0 < 6.5.19

ARKETEAM / BDF

0 < 6.4.67

References

NVD ↗ CVE.org ↗ EPSS Data ↗

protectel.arketeam.com: https://protectel.arketeam.com/ cert.pl: https://cert.pl/en/posts/2026/10/CVE-2025-68391/

Credits

Karol Miring