This vulnerability allows an attacker to upload arbitrary files and overwrite existing files in a temporary directory. If an authenticated user subsequently downloads the uploaded file, embedded JavaScript can be executed in the user's browser, leading to script injection and potential compromise of the user’s session or domain. The weakness is a classic arbitrary file upload flaw (CWE-434).

Arketeam’s Protectel modules PROTECTELMAJ and BDF are affected. Versions prior to PROTECTELMAJ 6.5.19 and BDF 6.4.67 remain vulnerable and must be updated. No other affected versions are listed.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting a lower probability of widespread exploitation at this time. An attacker must authenticate to upload a file; when the file is later downloaded by an authenticated user, malicious script execution can occur. The attack path requires local or network access to the application and the ability to upload files, which are common vectors in web deployments.