CVE-2025-31324

The Visual Composer Metadata Uploader component in SAP NetWeaver does not require authentication or verify permissions before accepting uploaded files. An attacker can transmit a potentially malicious executable file directly to the host server over the network (without the need to have an account or user interaction). The lack of authorization controls (CWE-434 — unrestricted upload of file with dangerous type) allows the uploaded file to be executed in the context of the server's operating system.

An attacker can gain complete control over the server — obtain full access to data (confidentiality), modify or destroy system resources (integrity), and cause its unavailability (availability). Successful exploitation of the vulnerability can lead to a serious breach of the organization's infrastructure.

Patches available from the vendor must be applied immediately in accordance with SAP Security Note 3594142 (https://me.sap.com/notes/3594142) and SAP Security Patch Day guidelines. Due to active exploitation in production environments, the update should be deployed as a priority; until the patch is installed, consider restricting network access to the Visual Composer component.

SAP NetWeaver with the Visual Composer Metadata Uploader component — specific versions indicated in the vendor references (SAP Security Note 3594142)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.