CVE-2025-42910 CRITICAL

CVE-2025-42910: Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management

Vendor Sap_Se
Product SAP Supplier Relationship Management
Weakness CWE-434 · Unrestricted file upload
Published October 14, 2025
Last update February 26, 2026

CVSS base score

9.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.

Key dates

02Disclosure timeline

October 14, 2025 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE