CVE-2026-24315
Path Traversal Vulnerability in SAP Fiori (launchpad)
- State
- Published
- Severity
- 4.2 Medium
- Published
- Jun 9, 2026
- Updated
- Jun 9, 2026
- Reserved
- Jan 21, 2026
Description
SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N | sap |
Weaknesses
- CWE-35 Path Traversal
Affected Products
| Product | Versions |
|---|---|
SAP Fiori (launchpad)SAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.