CVE-2025-42910— Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management
Quick assessment
Affected
SAP_SE SAP Supplier Relationship Management
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Supplier Relationship Management（SRM）是德国思爱普（SAP）公司的一套供应商关系管理解决方案。该产品实现了企业内以及供应商之间采购和购置流程的自动化，并提供发票开具等功能。 SAP Supplier Relationship Management存在代码问题漏洞，该漏洞源于缺少文件类型或内容验证，可能导致上传任意文件，影响应用程序的机密性、完整性和可用性。
Possible ATT&CK Techniques 2 AI
T1505 · Server Software Component T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-42910
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management
Source: CVE Program / CVE List V5
Vulnerability Description
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Supplier Relationship Management 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Supplier Relationship Management（SRM）是德国思爱普（SAP）公司的一套供应商关系管理解决方案。该产品实现了企业内以及供应商之间采购和购置流程的自动化，并提供发票开具等功能。 SAP Supplier Relationship Management存在代码问题漏洞，该漏洞源于缺少文件类型或内容验证，可能导致上传任意文件，影响应用程序的机密性、完整性和可用性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Supplier Relationship Management | SRMNXP01 100 | - |
|
II. Public POCs for CVE-2025-42910
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-42910
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-10-14 · 9 CVEs total
| CVE-2025-42937 | 9.8 CRITICAL | Directory Traversal vulnerability in SAP Print Service |
| CVE-2025-42901 | 5.4 MEDIUM | Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser) |
| CVE-2025-42908 | 5.4 MEDIUM | Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for AB |
| CVE-2025-42902 | 5.3 MEDIUM | Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform |
| CVE-2025-42906 | 5.3 MEDIUM | Directory Traversal vulnerability in SAP Commerce Cloud |
| CVE-2025-42903 | 4.3 MEDIUM | User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Cla |
| CVE-2025-42939 | 4.3 MEDIUM | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements) |
| CVE-2025-42909 | 3.0 LOW | Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-434
-
CVE-2026-103474
yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE -
CVE-2026-102427
Joomla Extension - ordasoft.com - Unauthenticated Remote Cod -
CVE-2026-102454
DigiWin｜EasyFlow .NET - Arbitrary File Upload -
CVE-2026-102842
gedelumbung HospitalManagement KCFinder File Manager app_use -
CVE-2026-70356
Toptech TMS7 and TopHAT Unrestricted Upload of File with Dan
V. Comments for CVE-2025-42910
No comments yet