PT-2025-7901 · Esri · Esri Arcgis Allsource

Published 2025-02-04 · Updated 2025-06-20 · CVE-2025-1068

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Esri ArcGIS AllSource versions 1.2 through 1.3

Description The issue is related to an untrusted search path vulnerability that could allow a low-privileged attacker with write privileges to the local file system to introduce a malicious executable. This executable could run malicious commands under the context of the victim when a specific action is performed using the software.

Recommendations For Esri ArcGIS AllSource versions 1.2 through 1.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2025-02460

CVE-2025-1068

Affected Products

Esri Arcgis Allsource

References · 9

• https://esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02460 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-1068 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1068 · Vendor Advisory
• https://twitter.com/CVEnew/status/1894428578235752569 · Twitter Post
• https://t.me/cvedetector/18888 · Telegram Post
• https://twitter.com/vulns_space/status/1894439353021055277 · Twitter Post
• https://t.me/cvenotify/112519 · Telegram Post
• https://t.me/cvenotify/126319 · Telegram Post