---
id: "CVE-2025-31324"
kind: "vulnerability"
aliases: ["CVE-2025-31324"]
title: "SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "SAP NetWeaver", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "sap netweaver", "fixed": [], "affected": "= 7.50", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "netweaver", "ransomware", "runtime", "sap", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2025-04-24T17:15:35+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31324", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31324", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing…

SAP NetWeaver's Visual Composer Metadata Uploader accepts file uploads without restriction, so an unauthenticated attacker can upload executable binaries to the server. CISA lists it as exploited in the wild and tagged with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver affected ? fixed ?
- vendor:sap netweaver affected = 7.50 fixed ?

## Fix

Apply the mitigations SAP publishes for CVE-2025-31324; if none are available, CISA's required action is to discontinue use of the product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31324
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-31324

## From the sources

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_