CVE-2025-42894
Path Traversal vulnerability in SAP Business Connector
- State
- Published
- Severity
- 6.8 Medium
- Published
- Nov 11, 2025
- Updated
- Feb 26, 2026
- Reserved
- Apr 16, 2025
Description
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server, resulting in a complete compromise of the confidentiality, integrity, and availability of the affected system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | sap |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Affected Products
| Product | Versions |
|---|---|
SAP Business ConnectorSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.