Esri ArcGIS Server
CVE-2025-67706
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Network unauthenticated but AC:H for the required race/secret/MitM precondition; only integrity impact (writing junk files) applies - C:N and A:N since the description denies data access and service disruption.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories.
However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data.
Because the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.
AnalysisAI
Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.
Technical ContextAI
The root cause is an input-validation gap in the file-upload handling of ArcGIS Server, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The vendor states uploaded files are not sufficiently validated before being written to the server's designated upload directories, but that platform architecture enforces non-executable storage locations and blocks modification or replacement of existing application components or system configuration. Consequently the classic CWE-434 escalation chain (upload a web shell, execute it, take over the host) is broken: uploaded artifacts cannot be executed, cannot be used for privilege escalation, and cannot be used to reach sensitive data. The affected CPE is cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:* - a wildcard that flags all ArcGIS Server versions, whereas the vendor advisory scopes the issue to 11.5 and earlier on both Windows and Linux. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L for the vendor's 5.6 score) confirms network reachability and no authentication requirement (PR:N), while AC:H captures the vendor-noted need for a race condition, knowledge of secret values, or a man-in-the-middle position - preconditions that make reliable exploitation opportunistic rather than deterministic. Our independent assessment scores the same AV:N/AC:H/PR:N/UI:N/S:U parameters but reduces the CIA impact to integrity-only (C:N/I:L/A:N), reflecting that a file landing in a non-executable upload directory is a write-with-limited-consequence rather than a confidentiality or availability event.
RemediationAI
The primary fix is the vendor patch published as part of the ArcGIS Server Security 2025 Update 2 Patch, available per the Esri advisory at https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-2-patch - no exact fixed build number is published in the data available here, so confirm the specific patched version for each installed ArcGIS Server component against that advisory before closing the finding. Because exploitation requires a race condition, knowledge of secret values, or a man-in-the-middle position, reducing network exposure is a meaningful compensating control until patching completes: place the server behind a reverse proxy or WAF that authenticates and rate-limits requests to the upload-handling endpoints and restrict those endpoints to trusted administrative networks, accepting that this can break legitimate publishing and content-ingestion workflows that depend on unauthenticated uploads. Enforcing TLS end-to-end with certificate validation removes the man-in-the-middle precondition, at the cost of managing certificate trust across clients. Rotating any shared secret values that may be known to untrusted parties removes the second exploitation precondition. Logging and alerting on writes into the server's designated upload directories provides detection of attempted abuse, with the trade-off that file-content monitoring adds storage and analysis overhead. In all cases, patching remains the durable fix; the network, TLS, and secret-rotation measures are temporary risk reduction, and the architecture already limits uploaded files to non-executable storage, so no emergency service shutdown is warranted on the strength of this issue alone.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today