CVE-2025-42906CWE-22path-traversal

CVE-2025-42906

Medium · published October 14, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on the integrity or availability of the application.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-14T05:15Z
References (2)
https://me.sap.com/notes/3634724 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 14 OCT 00:17Z
    Directory Traversal vulnerability in SAP Commerce Cloud
    cvelistv5