CVE-2025-31324 Known ransomware use

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP — NetWeaver

Added to KEV catalog: 29 April 2025
Federal remediation due date: 20 May 2025
Weakness classification (CWE): CWE-434

CISA Description

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324

View on NVD View on MITRE CVE View full CISA catalog

More SAP Vulnerabilities

CVE-2025-42999

SAP NetWeaver Deserialization Vulnerability

CVE-2017-12637

SAP NetWeaver Directory Traversal Vulnerability

CVE-2019-0344

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

CVE-2022-22536

SAP Multiple Products HTTP Request Smuggling Vulnerability

CVE-2021-38163

SAP NetWeaver Unrestricted File Upload Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services