CVE-2025-67260
Published: 20 March 2026
Summary
CVE-2025-67260 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Aster-Te Terrapack Tkservercgi. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67260 is a file upload vulnerability in Terrapack software developed by ASTER TEC / ASTER S.p.A. The flaw affects specific components, including Terrapack TkWebCoreNG version 1.0.20200914, Terrapack TKServerCGI version 2.5.4.150, and Terrapack TpkWebGIS Client version 1.0.0. It enables attackers to execute arbitrary code and is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability was published on 2026-03-20.
Attackers with low privileges, such as authenticated users, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, primarily through arbitrary code execution via malicious file uploads.
Mitigation details and advisories are available from vendor sources at http://aster.com and http://terrapack.com, as well as security repositories including https://github.com/edi-marc/Vulnerability_List/tree/main/CVE_Terrapack, https://packetstorm.news/files/id/217271, and https://www.acn.gov.it/portale/en/csirt-italia. Security practitioners should consult these for patching instructions and workarounds.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208903
Vulnerability details
The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS…
more
Client 1.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in a web application directly enables remote code execution by uploading/executing a malicious file, commonly a web shell, via exploitation of a public-facing app.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the file upload vulnerability by requiring identification, reporting, and timely patching of the affected Terrapack components.
Prevents arbitrary code execution by enforcing validation of uploaded files to reject dangerous types and malicious content in vulnerable Terrapack web components.
Protects against exploitation by scanning and blocking malicious code in files uploaded through the unrestricted upload mechanism in Terrapack TkWebCoreNG, TKServerCGI, and TpkWebGIS Client.