PT-2025-41842 · Sap · Sap Supplier Relationship Management

Published 2025-10-14 · Updated 2025-10-14 · CVE-2025-42910

Positive Technologies · (AI Summary)

CVSS v3.1

9.0

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management (affected versions not specified)

Description SAP Supplier Relationship Management does not properly verify the type or content of uploaded files. This allows an authenticated attacker to upload arbitrary files, including potentially malicious executables. If these files are downloaded and executed by users, they could host malware, leading to severe security breaches impacting confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-42910

Affected Products

Sap Supplier Relationship Management

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-42910 · Security Note
• https://twitter.com/ZeroPathLabs/status/1977916884730159469 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/VulmonFeeds/status/1977954203071816018 · Twitter Post
• https://twitter.com/CVEnew/status/1977903150829842468 · Twitter Post
• https://me.sap.com/notes/3647332 · Note
• https://twitter.com/CCBalert/status/1978155949899542710 · Twitter Post
• https://twitter.com/CveFindCom/status/1977897236387320174 · Twitter Post
• https://twitter.com/CveTodo/status/1977909453719482708 · Twitter Post
• https://twitter.com/Dinosn/status/1977953473640755275 · Twitter Post