CVE-2025-55267 is an unrestricted file upload flaw in HCL Aftermarket DPC, scored CVSS 5.7 (medium). The record says an attacker could upload and run malicious scripts and take control of the server. Confirm the fixed build in HCL's article and update.
What's affected
The NVD record lists HCL Aftermarket DPC and no version ranges. It sits alongside CVE-2025-55261, CVE-2025-55269 and CVE-2025-55270, all from the same HCL knowledge base article.
The HCL support portal did not return article text when I fetched it, so this guide relies on the NVD record. Read the article itself for the fixed version.
How to check if you're exposed
HCL publishes the affected and fixed builds for Aftermarket DPC in its knowledge base article, and that article is the authority. I could not read its text when preparing this guide, so I will not state a fixed version here.
- Find the build you run. The admin or about page of the product usually shows it, and so does your deployment record.
- Open the HCL article listed under Sources and compare your build with its list of affected and fixed builds.
- If the article lists a fix and you are behind it, you are exposed to the issue described here. If your build is not named, ask HCL support to confirm in writing.
For upload handling, find where the application stores uploaded files. If that folder is served by the web server and allowed to run scripts, the risk is higher, and moving the folder out of the web root is a sensible interim control.
What to do now
- List all Aftermarket DPC servers and their builds.
- Apply the build named in the HCL article.
- Check where uploads are stored. Keep them outside any path the web server executes.
- Disable script execution in the upload directory at the web server level.
- Scan the upload directory for files you do not expect, such as scripts or executables, and investigate any you find.
Why it matters
The class is CWE-434, unrestricted upload of a dangerous file type. The risk grows with each missing control: type checks, renaming, a storage location the server cannot execute, and size limits.
The medium score reflects the conditions needed to reach the upload. Even so, the stated impact is full control of the server, so the fix and the storage hardening deserve prompt attention.
Quick check
Why is a medium score paired with a full server compromise claim?
CVSS scores the conditions needed to reach the flaw as well as the impact. Here the impact is high, but reaching it requires specific access, which lowers the number.
Sources
Last reviewed: 19 October 2026.
