{"id":"CVE-2025-31324","kind":"vulnerability","aliases":["CVE-2025-31324"],"related":[],"title":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing…","description":"SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"SAP NetWeaver's Visual Composer Metadata Uploader accepts file uploads without restriction, so an unauthenticated attacker can upload executable binaries to the server. CISA lists it as exploited in the wild and tagged with ransomware use.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2025-04-29T00:00:00+00:00","products":[{"name":"SAP NetWeaver","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sap netweaver","fixed":[],"affected":"= 7.50","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","netweaver","ransomware","runtime","sap","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations SAP publishes for CVE-2025-31324; if none are available, CISA's required action is to discontinue use of the product.","status":"open","published_at":"2025-04-24T17:15:35+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:43+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T20:48:43Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations SAP publishes for CVE-2025-31324; if none are available, CISA's required action is to discontinue use of the product.","reach":"internet","summary":"SAP NetWeaver's Visual Composer Metadata Uploader accepts file uploads without restriction, so an unauthenticated attacker can upload executable binaries to the server. CISA lists it as exploited in the wild and tagged with ransomware use.","category":"runtime","who_cares":["sap","netweaver","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker uploads an executable binary and runs code on the NetWeaver server.","analyst_note":"Find SAP's security note for CVE-2025-31324 and the list of affected NetWeaver releases and the Visual Composer component, to fill in how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000438,"input_tokens":2553,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':104C '-2025':16A,19A '-31324':17A,20A '22':103C 'accept':40B 'action':94C 'agent':85C 'allow':14A,82C 'appli':95C 'applic':101C 'attack':48B 'author':13A 'binari':52B,91C 'bod':102C 'cisa':56B,92C 'cloud':107C 'compos':4A,37B,72C 'contain':75C 'cve':15A,18A 'discontinu':110C 'execut':51B,90C 'exploit':25B,60B 'file':41B,78C 'follow':100C 'guidanc':105C 'host':32B 'instruct':99C 'list':57B 'malici':89C 'metadata':5A,38B,73C 'mitig':96C,116C 'netweav':2A,26B,34B,70C 'netweaver':22A,24A 'per':97C 'potenti':88C 'product':114C 'proper':12A 'protect':9A 'ransomwar':27B,67B 'requir':93C 'restrict':44B 'runtim':28B 'sap':1A,21A,23A,29B,33B,69C 'self':31B 'self-host':30B 'server':55B 'servic':108C 'tag':65B 'unauthent':47B,84C 'unavail':118C 'unrestrict':77C 'upload':6A,39B,42B,50B,74C,79C,87C 'use':68B,111C 'vendor':98C 'visual':3A,36B,71C 'vulner':80C 'wild':63B 'without':43B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-04-24T17:15:35+00:00","kev":{"dateAdded":"2025-04-29","dueDate":"2025-05-20","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-31324","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31324","severity":null,"published_at":"2025-04-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-31324","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31324","severity":null,"published_at":"2025-04-24T17:15:35+00:00","modified_at":"2026-08-04T05:16:34+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}