# ARKETEAM Protectel multiple vulnerabilities incl. unrestricted file upload (CVE-2025-68391) and SQL injection (CVE-2025-68393, CVE-2025-68394)

> CERT Polska disclosed five vulnerabilities in ARKETEAM Protectel (modules PROTECTELMAJ and BDF): unrestricted file upload (CVE-2025-68391), incorrect authorization (CVE-2025-68392), two SQL injections (CVE-2025-68393, CVE-2025-68394) and stored XSS in the note editor (CVE-2025-68395). Fixed in PROTECTELMAJ 6.5.19 and BDF 6.4.67; no in-the-wild exploitation or public PoC is reported.

- **Published:** 2026-11-01T04:14:44Z
- **Last reviewed:** 2026-11-01T04:14:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4957
- **ID:** TL-2026-4957
- **Severity:** HIGH (CVSS 8.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-68391, CVE-2025-68392, CVE-2025-68393, CVE-2025-68394, CVE-2025-68395

## Description

On 30 October 2026 CERT Polska (CNA CERT-PL) published coordinated-disclosure advisories and CVE records for five vulnerabilities in ARKETEAM Protectel, a French compliance and risk-management platform for financial institutions. The vendor describes it as a single portal/API for KYC/KYB due diligence, AML screening, continuous third-party monitoring, a scenario engine and Banque de France integration (incident file declarations such as FCC, FICP, FNCI), used by 170+ financial institutions with data hosted in France. All five flaws affect the PROTECTELMAJ module before 6.5.19 and the BDF module before 6.4.67. The reporter credited is Karol Miring. The CVE IDs were reserved on 2025-12-16 and published on 2026-10-30.

CVE-2025-68391 (CWE-434) allows any user to upload an arbitrary file and override existing files in a temporary folder; the advisory notes this could lead to JavaScript execution when authenticated users download the uploaded file. The CVE record scores it CVSS 4.0 5.3 MEDIUM (AV:A/PR:N, low integrity impact). CVE-2025-68392 (CWE-863) lets low-privileged users use functionality reserved for administrators by forging direct requests to a specific endpoint (CVSS 4.0 5.1 MEDIUM, AV:A/PR:L).

CVE-2025-68393 and CVE-2025-68394 (CWE-89) are SQL injections caused by improper neutralization of input supplied by a low-privileged user in the 'Utilisateur' and 'profilInput' parameters respectively. The CVE records score both CVSS 4.0 8.4 HIGH (AV:A/PR:H) with high confidentiality and integrity impact and low availability impact on the vulnerable system. CVE-2025-68395 (CWE-79) is a stored XSS in the note editor: a low-privileged attacker can inject arbitrary HTML and JS into notes that is rendered/executed when a user visits the module (CVSS 4.0 5.1 MEDIUM, AV:A/PR:N/UI:P).

The CVE records use an adjacent-network attack vector (AV:A), suggesting the application is primarily reachable from internal or restricted networks. The sources state no CVSS from CERT Polska itself, no known exploitation, no public proof of concept (a web search found none) and no IOCs. Chaining is plausible in principle (authorization bypass, upload or stored XSS to reach privileged sessions, then SQL injection against the backend database), but the sources document no chain; this is an analyst inference, not an evidenced attack. Defenders should patch to PROTECTELMAJ 6.5.19 / BDF 6.4.67 and monitor for the vulnerability classes described.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1213 Data from Information Repositories
- T1565.001 Stored Data Manipulation

## Sources

- [Vulnerabilities in ARKETEAM Protectel software - CERT Polska](https://cert.pl/en/posts/2026/10/CVE-2025-68391/)
- [CVE-2025-68391 record (CNA CERT-PL)](https://www.cve.org/CVERecord?id=CVE-2025-68391)
- [CVE-2025-68392 record (CNA CERT-PL)](https://www.cve.org/CVERecord?id=CVE-2025-68392)
- [CVE-2025-68393 record (CNA CERT-PL)](https://www.cve.org/CVERecord?id=CVE-2025-68393)
- [CVE-2025-68394 record (CNA CERT-PL)](https://www.cve.org/CVERecord?id=CVE-2025-68394)
- [CVE-2025-68395 record (CNA CERT-PL)](https://www.cve.org/CVERecord?id=CVE-2025-68395)
- [ARKETEAM Protectel product page (vendor)](https://arketeam.com/protectel/)
- [ARKETEAM Protectel homepage referenced in CVE records](https://protectel.arketeam.com/)
- [CWE-434 Unrestricted Upload of File with Dangerous Type](https://cwe.mitre.org/data/definitions/434.html)
- [CWE-89 SQL Injection](https://cwe.mitre.org/data/definitions/89.html)
- [CWE-863 Incorrect Authorization](https://cwe.mitre.org/data/definitions/863.html)
- [CWE-79 Cross-site Scripting](https://cwe.mitre.org/data/definitions/79.html)
- [CERT Polska coordinated vulnerability disclosure policy](https://cert.pl/en/cvd/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4957