CVE-2025-63748 is a file upload vulnerability in QaTraq 6.9.2 where authenticated users can upload arbitrary files, including executable PHP scripts, via the Add Attachment feature in the Test Script module. The lack of file type restrictions allows attackers to upload malicious PHP payloads that are executed when accessed through the View Attachment option, resulting in remote code execution on the server. This vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Successful exploitation allows an authenticated user to execute arbitrary PHP code on the server, leading to full compromise of confidentiality, integrity, and availability of the affected system. This includes the potential for remote code execution, data theft, system manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Add Attachment feature to trusted users only and consider disabling file uploads or implementing manual review of uploaded files. Employ web application firewalls or other security controls to detect and block malicious file uploads and execution attempts.