PT-2025-28289 · Sap · Sapcar

Published 2025-07-08 · Updated 2025-07-24 · CVE-2025-42970

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SAPCAR (affected versions not specified)

Description: The issue arises from SAPCAR's improper sanitization of file paths during the extraction of SAPCAR archives. This allows an attacker to create a malicious archive with directory traversal sequences. When a high-privileged user extracts this archive, SAPCAR processes it, potentially extracting files outside the intended directory and overwriting files in arbitrary locations. This has a significant impact on the application's integrity and availability, with no effect on confidentiality.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-16217

CVE-2025-42970

Affected Products

Sapcar

References · 8

• https://bdu.fstec.ru/vul/2025-16217 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42970 · Security Note
• https://twitter.com/CVEnew/status/1942418290241880398 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/gothburz/status/1942637640626418129 · Twitter Post
• https://twitter.com/jmdevlabs/status/1948528938151506345 · Twitter Post
• https://me.sap.com/notes/3595156 · Note