PT-2025-54464 · Esri · Arcgis Server

Published 2025-12-31 · Updated 2026-02-19 · CVE-2025-67706

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 11.5 and earlier

Description ArcGIS Server on Windows and Linux does not properly validate uploaded files, potentially allowing remote attackers to upload arbitrary files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-67706

Affected Products

Arcgis Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-67706 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67706 · Vendor Advisory
• https://esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-2-patch · Vendor Advisory
• https://twitter.com/CVEnew/status/2006495349897060436 · Twitter Post
• https://t.me/cveNotify/151086 · Telegram Post
• https://t.me/cveNotify/152508 · Telegram Post
• https://t.me/cveNotify/147894 · Telegram Post
• https://t.me/cveNotify/152524 · Telegram Post
• https://t.me/cveNotify/147424 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2006522550533120151 · Twitter Post
• https://t.me/cveNotify/152359 · Telegram Post
• https://t.me/CVEtracker/41137 · Telegram Post