Esri ArcGIS Server Unrestricted File Upload Vulnerability

A vulnerability exists in Esri ArcGIS Server versions 11.5 and earlier on both Windows and Linux. The issue stems from improper validation of uploaded files, which enables remote attackers to upload arbitrary files. This vulnerability is classified as unrestricted file upload of dangerous types, potentially leading to various security risks depending on the nature of the uploaded files.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, which could be used to upload malicious files that may be executed on the server or cause other types of harm, such as overwriting existing files or disrupting server operations.

Remediation

Users are advised to update to ArcGIS Server Security 2025 Update 2, which is available for download from the Esri Support site. This patch addresses this vulnerability and should be applied as soon as possible.