CVE-2025-31324 SAP NetWeaver Unrestricted File Upload
Unauthenticated attackers can upload malicious binaries to SAP NetWeaver Visual Composer due to missing authorization checks, leading to potential system compromise.
- Exploited in the wild
- Since 29 Apr 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-31324?
CVE-2025-31324 is a critical missing authorization vulnerability in Sap Netweaver, published on 24 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Weakness: CWE-434
Which versions are affected by CVE-2025-31324?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2025-31324?
No fix has been published for CVE-2025-31324 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 20 May 2025.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-31324 being exploited?
Yes. Attackers have exploited CVE-2025-31324 in the wild since at least 29 Apr 2025, including in ransomware campaigns.
Public exploit code: 1 Nuclei template and 23 proofs of concept on GitHub.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-7w9p-pr7x-mjw2.