CVE-2025-42937

Published Oct 14, 2025

Last updated 4 months ago

CVSS critical 9.8
SAP

Overview

Description
SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application.
Source
cna@sap.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

cna@sap.com
CWE-35

Social media

Hype score
Not currently trending

  1. Remote Code Execution in SAP-Druckprotokoll: Sicherheitslücke CVE-2025-42937 betrifft tausende Unternehmen - Sicherheitsforscher entdecken Schwachstelle im SAP-Druckprotokoll https://t.co/zDH8hyiwuf #sap #sapsecurity

    @KolaricDav5471

    16 Feb 2026

    25 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2025-42937 (CVSS:9.8, CRITICAL) is Awaiting Analysis. SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated..https://t.co/PfjmwvCMy4 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    19 Oct 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. **CVE-2025-42937** pertains to the SAP Print Service (SAPSprint), a component responsible for handling printing tasks within SAP environments. The vulnerability arises from insufficient validation of user-supplied path information, enabling an attacker to perform directory

    @CveTodo

    14 Oct 2025

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2025-42937 SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directo… https://t.co/WFqMEr2QDY

    @CVEnew

    14 Oct 2025

    338 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. [CVE-2025-42937: CRITICAL] SAPSprint vulnerability allows attackers to overwrite system files, compromising data integrity, confidentiality, and system availability. Ensure validation of user-provided path i...#cve,CVE-2025-42937,#cybersecurity https://t.co/LdUApmJsQ6 https://t.c

    @CveFindCom

    14 Oct 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-58231
  2. SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.•CVE-2026-34265
  3. SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-44758
  4. SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.•CVE-2026-44761
  5. Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.•CVE-2026-27690

References

Sources include official advisories and independent security research.