CVE-2025-42894 Path Traversal vulnerability in SAP Business Connector

Medium 6.8 Published 11 Nov 2025 Updated 26 Feb 2026

An authenticated administrator can exploit path traversal to read, write, or delete arbitrary files, leading to arbitrary code execution and full system compromise.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-42894?

CVE-2025-42894 is a medium-severity path traversal vulnerability in SAP_SE SAP Business Connector, published on 11 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server, resulting in a complete compromise of the confidentiality, integrity, and availability of the affected system.

Weakness: CWE-22

Which versions are affected by CVE-2025-42894?

It affects 1 product.

Products include Sap Business Connector.

How do I fix CVE-2025-42894?

No fix has been published for CVE-2025-42894 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-42894 being exploited?

There is no known exploitation of CVE-2025-42894 in the wild and no public exploit code.

Sources

Also known as GHSA-p996-cqr5-xw36.