Critical severity · published Mar 26, 2026
CVE-2025-55267
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Aftermarket DPC · HCL
version 1.0.0 · source: vendor
AC
Aftermarket Cloud · Hcltech
1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55267
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793
More from Aftermarket DPC
9.8
CVE-2025-55261
HCL Aftermarket DPC is affected by Missing Functional Level Access Control
9.8
CVE-2025-55269
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability
9.8
CVE-2025-55270
HCL Aftermarket DPC is affected by Improper Input Validation
8.8
CVE-2025-55271
HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability
8.1
CVE-2025-55275
HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability