# ARKETEAM Protectel patches five vulnerabilities

Published: 2026-10-30 · Severity: routine
Canonical: https://vorant.io/reports/353b1908-28a0-5273-9d18-fed213ae1dc1/arketeam-protectel-patches-five-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT Polska coordinated disclosure of five flaws in ARKETEAM Protectel, including file upload, SQLi, broken access control and XSS, fixed in updates.

Source: cert.pl — https://cert.pl/en/posts/2026/10/CVE-2025-68391

## What to check

- Applies to: The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska disclosed five vulnerabilities in ARKETEAM's Protectel software, affecting both the PROTECTELMAJ and BDF modules. The flaws were reported to CERT Polska and coordinated through its vulnerability disclosure process. All versions of PROTECTELMAJ prior to 6.5.19 and BDF prior to 6.4.67 are affected.

The vulnerabilities span multiple classes: CVE-2025-68391 allows any user to upload arbitrary files and overwrite files in a temporary folder, potentially leading to execution of embedded JavaScript when an authenticated user downloads the file. CVE-2025-68392 is an incorrect authorization flaw letting low-privileged users invoke admin-reserved functionality by forging direct requests to a specific endpoint. CVE-2025-68393 and CVE-2025-68394 are SQL injection vulnerabilities reachable by low-privileged users via the Utilisateur and profilInput parameters, respectively. CVE-2025-68395 is a stored XSS in the note editor module, allowing a low-privileged attacker to inject HTML/JS that executes when other users view the notes.

No evidence of in-the-wild exploitation is mentioned. Defenders using Protectel should upgrade PROTECTELMAJ to v6.5.19 and BDF to v6.4.67, and monitor for anomalous file uploads, unexpected admin-level actions by low-privileged accounts, and unusual database query patterns or injected script content in notes modules.

## Mentioned in this report

- Vulnerabilities: CVE-2025-68391, CVE-2025-68392, CVE-2025-68393, CVE-2025-68394, CVE-2025-68395

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2025-68391

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/353b1908-28a0-5273-9d18-fed213ae1dc1/arketeam-protectel-patches-five-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup