A file upload flaw in the Terrapack software suite allows an attacker to upload code that the system will execute with the privileges of the web server. The vulnerability is categorized as an untrusted file upload (CWE-434). An attacker who can send a malicious file to the affected components can run arbitrary commands, potentially compromising confidentiality, integrity, and availability of the host.

The flaw exists in ASTER TEC’s Terrapack package. Affected components and versions are: Terrapack TkWebCoreNG 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0. These are delivered by ASTER S.p.A.

The issue receives a CVSS score of 8.8, indicating high severity, but an EPSS of less than 1% suggests it is currently rarely exploited. It is not listed in the CISA KEV catalog. The most likely attack vector is a remote exploit, where an attacker submits a malicious file through a publicly exposed upload endpoint. Successful exploitation would grant remote code execution privileges.