CVE-2025-42906
Directory Traversal vulnerability in SAP Commerce Cloud
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 14, 2025
- Updated
- Oct 14, 2025
- Reserved
- Apr 16, 2025
Description
SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on the integrity or availability of the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | sap |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Affected Products
| Product | Versions |
|---|---|
SAP Commerce CloudSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.