CVE-2025-67707
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server's designated upload directories. However, the server's architecture restricts uploaded files to non-executable storage locations and prevents modification or replacement of existing components, so the impact is low.
Risk Assessment
Despite low impact, an attacker can fill upload directories, potentially causing resource exhaustion or disruption, but not system takeover.
Recommendation
Update ArcGIS Server to the latest version and monitor upload directories for unauthorized files.
Other vulnerabilities in ArcGIS Server
See all- CVE-2026-9181Critical
ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker can send crafted path parameters, allowing overwriting sensitive files on the system. Exploitation can lead to full administrative access to ArcGIS Server, with high impact on confidentiality, integrity, and availability.
- CVE-2026-2813Medium
ArcGIS Server has an input validation weakness in the login redirection workflow. An authenticated attacker can send a crafted request, causing the browser to redirect to an untrusted site, resulting in limited confidentiality impact under specific user interaction. The vulnerability affects ArcGIS Server 11.5.
- CVE-2026-2812Medium
ArcGIS Server has an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker can send a crafted request to this endpoint, potentially disrupting the web-based browsing interface. This affects ArcGIS Server 12.0 and earlier.
- CVE-2025-67706Medium
ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server's designated upload directories. However, the server's architecture restricts uploaded files to non-executable storage locations and prevents modification or replacement of existing components, so the impact is low.
Original NVD description (English source)
ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data. Because the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS