Esri ArcGIS Server Unrestricted File Upload Vulnerability

A vulnerability exists in Esri ArcGIS Server versions 11.5 and earlier on both Windows and Linux. The issue stems from improper validation of uploaded files, allowing remote attackers to upload arbitrary files. This vulnerability is categorized as unrestricted file upload of dangerous types, which could potentially lead to further exploitation.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, which may be used to execute malicious files on the server or disrupt service.

Remediation

Users are advised to update to ArcGIS Server version 12.0 or to install the ArcGIS Server Security 2025 Update 2 Patch, which is available through the Esri Support site. This patch addresses several vulnerabilities and can be applied without needing to install previous updates.