CVE-2025-55267
Published: 26 March 2026
Summary
CVE-2025-55267 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Hcltech Aftermarket Cloud. Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).
Deeper analysis
CVE-2025-55267 is an Unrestricted File Upload vulnerability affecting HCL Aftermarket DPC. This flaw enables an attacker to upload and execute malicious scripts, potentially gaining full control over the affected server. The vulnerability is associated with CWE-434 and has a CVSS v3.1 base score of 5.7 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N), indicating network accessibility, low attack complexity, requirement for low privileges and user interaction, unchanged scope, high integrity impact, and no impact on confidentiality or availability. It was published on 2026-03-26.
An authenticated attacker with low privileges can exploit this vulnerability over the network by convincing a user to interact with a malicious upload, such as through a crafted file. Successful exploitation allows the attacker to execute arbitrary scripts on the server, leading to full control, including potential data manipulation or further compromise due to the high integrity impact.
For mitigation details, security practitioners should consult the official advisory from HCL Software at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209057
Vulnerability details
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload enabling upload+execution of arbitrary scripts on a network-accessible server directly facilitates initial access via public-facing application exploitation and web shell deployment for command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 enforces input validation and error handling at file upload interfaces to detect and reject malicious scripts, directly preventing exploitation of the unrestricted file upload vulnerability.
SI-9 restricts information inputs to safe file types and sources at upload endpoints, blocking unauthorized uploads of executable scripts.
SI-3 deploys malicious code protection mechanisms to scan and block uploaded scripts before execution on the server.