CVE-2025-67260: Terrapack File Upload RCE Vulnerability

CVE-2025-67260 Overview

CVE-2025-67260 is a file upload vulnerability affecting the Terrapack software suite developed by ASTER TEC / ASTER S.p.A. This vulnerability allows attackers to upload malicious files to the server, potentially leading to arbitrary code execution. The flaw stems from insufficient validation of uploaded file types and content, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact

Successful exploitation of this vulnerability could allow attackers with low-privilege network access to execute arbitrary code on affected systems, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

• Terrapack TkWebCoreNG version 1.0.20200914
• Terrapack TKServerCGI version 2.5.4.150
• Terrapack TpkWebGIS Client version 1.0.0

Discovery Timeline

• 2026-03-20 - CVE-2025-67260 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2025-67260

Vulnerability Analysis

This vulnerability is an unrestricted file upload flaw (CWE-434) that affects multiple components of the Terrapack software suite. The vulnerability allows authenticated attackers to bypass file type restrictions and upload files with dangerous extensions or malicious content. When these files are subsequently accessed or processed by the server, they can execute arbitrary code within the context of the web application.

The attack requires network access and low-level authentication, meaning an attacker needs valid credentials or an authenticated session to exploit the vulnerability. However, once authenticated, the exploitation does not require any user interaction, making it particularly dangerous in multi-user environments.

Root Cause

The root cause of CVE-2025-67260 lies in improper input validation within the file upload functionality of the Terrapack components. The application fails to adequately verify:

• File extension validation against a whitelist of safe file types
• MIME type verification to ensure content matches the declared file type
• File content inspection to detect embedded malicious code
• Proper sanitization of file names to prevent path traversal attacks

This lack of comprehensive file validation allows attackers to upload executable scripts or web shells that can be triggered through direct URL access.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the Terrapack application. The exploitation flow typically involves:

1. An attacker authenticates to the Terrapack application with valid credentials
2. The attacker identifies the vulnerable file upload endpoint within TkWebCoreNG, TKServerCGI, or TpkWebGIS Client components
3. A malicious file (such as a web shell or script) is uploaded, bypassing insufficient file type restrictions
4. The attacker accesses the uploaded file directly via its URL path
5. The malicious code executes with the privileges of the web application, potentially granting full server access

The vulnerability affects the confidentiality, integrity, and availability of the system, as successful exploitation can lead to data exfiltration, system modification, and service disruption.

Detection Methods for CVE-2025-67260

Indicators of Compromise

• Presence of unexpected executable files (.php, .jsp, .asp, .aspx) in upload directories
• Web server logs showing direct access to files in upload directories with unusual file extensions
• Outbound network connections from the web server process to unknown IP addresses
• Creation of new user accounts or modification of existing permissions on the affected system

Detection Strategies

• Monitor file system events for creation of executable files in web-accessible directories
• Implement web application firewall (WAF) rules to detect and block file upload attempts with dangerous extensions
• Review web server access logs for patterns indicating web shell activity, such as command execution parameters in URLs
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation behavior

Monitoring Recommendations

• Enable detailed logging for all file upload operations within Terrapack applications
• Configure alerts for any file creation events in upload directories that don't match expected file types
• Monitor process execution chains originating from web server processes for anomalous child processes
• Implement network traffic analysis to detect command-and-control communications from compromised servers

How to Mitigate CVE-2025-67260

Immediate Actions Required

• Restrict network access to affected Terrapack components to trusted IP addresses only
• Review and remove any suspicious files from upload directories on affected systems
• Implement additional authentication controls to limit access to file upload functionality
• Enable comprehensive logging and monitoring on affected systems until patches are applied

Patch Information

Organizations should contact ASTER TEC / ASTER S.p.A. directly for official security patches addressing CVE-2025-67260. Additional technical details and vendor information can be found through the following resources:

• Aster Website
• Terrapack Homepage
• GitHub Vulnerability List
• Packet Storm File ID #217271
• CSIRT Italia Page

Workarounds

• Implement strict file extension whitelisting at the web server level, allowing only known-safe file types
• Configure the web server to serve uploaded files with a Content-Disposition: attachment header to prevent direct execution
• Store uploaded files outside the web root directory and serve them through a controlled script that validates access
• Deploy a web application firewall (WAF) with rules specifically targeting file upload attacks and web shell detection

# Example Apache configuration to restrict file execution in upload directories
<Directory "/var/www/terrapack/uploads">
    # Disable script execution in upload directory
    Options -ExecCGI
    php_flag engine off
    
    # Restrict file types that can be accessed
    <FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|aspx|cgi|sh)$">
        Require all denied
    </FilesMatch>
    
    # Force downloads instead of execution
    <FilesMatch ".*">
        Header set Content-Disposition attachment
    </FilesMatch>
</Directory>