CVE-2025-67260

HIGH 8.8CVE-2025-67260 · Published 20/03/2026 · updated 05/07/2026

In short

CVE-2025-67260 is a HIGH (CVSS 8.8) vulnerability affecting terrapack tkservercgi (aster-te), terrapack tkwebcoreng (aster-te), terrapack tpkwebgis (aster-te).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
terrapack tkservercgi aster-te	`= 2.5.4.150`	No fix yet
terrapack tkwebcoreng aster-te	`= 1.0.20200914`	No fix yet
terrapack tpkwebgis aster-te	`= 1.0.0`	No fix yet

Description

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0.

References

edi-marc/Vulnerability_List · Third Party Advisory
packetstorm.news/files/id/217271 · Not Applicable
acn.gov.it/portale/en/csirt-italia · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free