CVE-2025-42937CWE-35

CVE-2025-42937

Critical · published October 14, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

🚨 An unauthenticated attacker can sneak into your system and overwrite files! This critical flaw in SAP Print Service (SAPSprint) is like leaving the back door wide open for unexpected guests. 🔥 Think of SAPSprint as a busy restaurant. If a delivery person is allowed to walk in without a check on what they’re carrying, they could swap out your entire menu with something terrible — potentially ruining your service! If exploited, an attacker could overwrite crucial system files, leading to a complete breakdown of application functionality. This breach could expose sensitive data, disrupt operations, and even render your application entirely unusable — a nightmare scenario for any organization!

Put simply

Think of SAPSprint as a busy restaurant. If a delivery person is allowed to walk in without a check on what they’re carrying, they could swap out your entire menu with something terrible — potentially ruining your service! This vulnerability arises from insufficient validation of path information provided by users, allowing attackers to navigate to parent directories and overwrite system files without any authentication.

What to do

If exploited, an attacker could overwrite crucial system files, leading to a complete breakdown of application functionality. This breach could expose sensitive data, disrupt operations, and even render your application entirely unusable — a nightmare scenario for any organization! To remediate this, patch SAPSprint to the latest version immediately. Additionally, implement strict input validation to ensure path information is appropriately sanitized and monitored. Regularly audit access controls to prevent unauthorized file operations. You've got this! By taking these steps, you'll be protecting your application like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00743 · 54.2th percentile
Weakness
CWE-35 · Path Traversal: '.../...//'
Published
2025-10-14T05:15Z
References (2)
EPSS history
Timeline
  • 14 OCT 00:18Z
    Directory Traversal vulnerability in SAP Print Service
    cvelistv5