CVE-2025-42977: Directory Traversal in SAP NetWeaver Visual Composer

Successful exploitation of CVE-2025-42977 could grant an attacker unauthorized access to sensitive data stored on the system. By manipulating input paths, an attacker can potentially read configuration files, source code, or other critical system files. This could lead to the exposure of credentials, proprietary information, or even allow for the modification of system behavior. The low integrity impact stems from the potential to alter files, though the primary risk is data confidentiality. A similar vulnerability in another SAP product previously led to data breaches, highlighting the potential severity.

1. Reserved2025-04-16
2. Published2025-06-10
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-42977 is to upgrade SAP NetWeaver Visual Composer to version 7.50.1 or later. If immediate upgrading is not feasible, consider implementing strict access controls and input validation on the Visual Composer application to limit the potential attack surface. While a direct WAF rule is difficult to implement for directory traversal, restricting access to sensitive file paths based on user roles can provide a layer of defense. Monitor system logs for unusual file access patterns or attempts to access files outside of expected directories.