SAP BUSINESSOBJECTS BUSINESS INTELLIGENCE PLATFORM (WEB INTELLIGENCE) · CVE-2026-109798 · Vendor
NO FIX YET · SEE WHAT TO DO
SAP BusinessObjects Business Intelligence Platform's Web Intelligence component does not restrict external entity resolution when processing OLAP connection requests. An authenticated attacker can read sensitive files on the server and reach internal systems that are not otherwise exposed.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted SAP BusinessObjects Business Intelligence Platform installations with Web Intelligence, listed as ENTERPRISE 430, 2025 and 2027 in the CVE record. An attacker needs a valid login, then sends OLAP connection requests whose XML entities are resolved, which can expose server files and internal systems. Teams that do not run Web Intelligence or that restrict logins to trusted users face lower risk.
Not affected if auth-required, unknown
Who cares businessobjects, sap, self-hosted, web-intelligence, xxe
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.