CVE-2025-67707: Unvalidated File Upload vulnerability in ArcGIS Server.

Vulnerability summary

CVE-2025-67707 is a medium (CVSS 5.6) vulnerability in esri arcgis server. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 22.7% of scored vulnerabilities.

Timeline

1. 31-12-2025
   PublishedVulnerability first disclosed.
2. 19-02-2026
   Last modifiedVulnerability information updated.

Description

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data. Because the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.