CVE-2025-42894
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system.
Risk Assessment
Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server, resulting in a complete compromise of confidentiality, integrity, and availability.
Recommendation
Update SAP Business Connector to a version containing the fix. Restrict administrative access and enforce least privilege.
Other vulnerabilities in SAP Business Connector
See all- CVE-2025-42893Medium
Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.
- CVE-2025-42892Medium
An OS Command Injection vulnerability exists in SAP Business Connector. An authenticated attacker with administrative access and adjacent network access could upload specially crafted content that, when processed, enables execution of arbitrary operating system commands.
- CVE-2025-42886Medium
SAP Business Connector contains a Reflected Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can create a malicious link and make it publicly accessible. When an authenticated victim opens the link, the injected input executes in their browser.
Original NVD description (English source)
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server, resulting in a complete compromise of the confidentiality, integrity, and availability of the affected system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS