Medium severity · published Nov 11, 2025
CVE-2025-42894
Path Traversal vulnerability in SAP Business Connector
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server, resulting in a complete compromise of the confidentiality, integrity, and availability of the affected system.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business Connector · SAP_SE
SAP BC 4.8 · source: vendor
BC
Business Connector · Sap
4.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-42894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-42894
Permissions Required
https://me.sap.com/notes/3666038
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from SAP Business Connector
6.8
CVE-2025-42892
OS Command Injection vulnerability in SAP Business Connector
6.1
CVE-2026-0514
Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
6.1
CVE-2025-42893
Open Redirect vulnerability in SAP Business Connector
6.1
CVE-2025-42886
Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
4.8
CVE-2024-30215
Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
