CVE-2025-42910 Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management
Authenticated attackers can upload arbitrary files, potentially leading to malware execution and high impact on confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-42910?
CVE-2025-42910 is a critical vulnerability in SAP_SE SAP Supplier Relationship Management, published on 14 Oct 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.
Weakness: CWE-434
Which versions are affected by CVE-2025-42910?
How do I fix CVE-2025-42910?
No fix has been published for CVE-2025-42910 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-42910 being exploited?
There is no known exploitation of CVE-2025-42910 in the wild and no public exploit code.
Sources
Also known as GHSA-m9f2-gpgf-6q7h.