CVE-2025-42910

Published Oct 14, 2025

Last updated 4 months ago

CVSS critical 9.0
SAP

Overview

Description
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.
Source
cna@sap.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9
Impact score
6
Exploitability score
2.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

cna@sap.com
CWE-434

Social media

Hype score
Not currently trending

  1. CVE-2025-42910 (CVSS:9.0, CRITICAL) is Awaiting Analysis. Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attack..https://t.co/XSTEjWkZdK #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    19 Oct 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2025-42910 – Critical Unrestricted File Upload Vulnerability in SAP SRM https://t.co/TLQJwcOOwV #patchmanagement

    @eyalestrin

    15 Oct 2025

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-42910 – Critical Unrestricted File Upload Vulnerability in SAP SRM https://t.co/gbhKups1Jv

    @Dinosn

    14 Oct 2025

    2033 Impressions

    4 Retweets

    8 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  4. Critical Unrestricted File Upload in SAP SRM (CVE-2025-42910) Attackers can upload malicious files, leading to full system compromise. Patch ASAP. For more details, read ZeroPath's blog on this vuln. #SAP #AppSec #InfoSec https://t.co/TIWSSI1mUJ

    @ZeroPathLabs

    14 Oct 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. **CVE-2025-42910** pertains to a security flaw in SAP Supplier Relationship Management (SAP SRM) where the system fails to properly verify the type or content of uploaded files. This oversight allows an authenticated attacker to upload arbitrary files, including potentially

    @CveTodo

    14 Oct 2025

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2025-42910 Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files coul… https://t.co/40dXec7XT4

    @CVEnew

    14 Oct 2025

    364 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. [CVE-2025-42910: CRITICAL] SAP Supplier Relationship Management vulnerability allows attackers to upload malicious files, risking malware infection and jeopardizing data security and system availability.#cve,CVE-2025-42910,#cybersecurity https://t.co/QdtaPilGu7 https://t.co/WmQuC

    @CveFindCom

    14 Oct 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-58231
  2. SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.•CVE-2026-34265
  3. SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-44758
  4. SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.•CVE-2026-44761
  5. Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.•CVE-2026-27690

References

Sources include official advisories and independent security research.