ARKETEAM Protectel modules PROTECTELMAJ and BDF contain an arbitrary file upload vulnerability that allows any user to upload files and overwrite existing files in a temporary folder. This flaw could lead to execution of embedded JavaScript when an authenticated user downloads the uploaded file. The issue has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.