CVE-2026-58248 in BusinessObjects Business Intelligence Platform
Summary
by MITRE • 08/11/2026
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within SAP BusinessObjects Business Intelligence Platform's Web Intelligence module where insufficient input validation allows attackers to craft malicious spreadsheet files containing external references that can be exploited for information disclosure. The flaw stems from the platform's failure to properly sanitize or restrict external resource resolution when processing data sources, creating a path for unauthorized access to server-side sensitive information through seemingly benign spreadsheet uploads.
The technical implementation of this vulnerability leverages the platform's legitimate data import capabilities while exploiting a design weakness in how external references are handled during file processing. When a crafted spreadsheet containing malicious external references is uploaded and processed as a data source, the system automatically resolves these references without adequate security controls or access restrictions. This behavior aligns with CWE-22 Path Traversal and CWE-94 Code Injection patterns where improper input handling leads to unauthorized resource access and information disclosure.
The operational impact of this vulnerability is severe as it enables low-privileged attackers to potentially extract sensitive data from server-side files that should remain protected. Attackers can craft spreadsheets containing references to configuration files, database connection strings, user credentials, or other confidential server resources that become visible in the resulting report output. The confidentiality impact is classified as high because adversaries can gain access to critical business intelligence and system information without requiring elevated privileges or sophisticated attack vectors.
This vulnerability demonstrates a classic server-side request forgery pattern where the application acts as an intermediary to resolve external references, creating an attack surface that can be exploited for data exfiltration. The lack of proper access controls during external reference resolution means that any user with upload privileges can potentially access restricted server files through this mechanism. Organizations using SAP BusinessObjects platforms may experience unauthorized data exposure and potential compliance violations when this vulnerability is exploited in production environments.
The mitigation strategy should focus on implementing strict input validation for all spreadsheet file uploads, restricting external resource resolution capabilities during data processing, and deploying network-level controls to prevent access to sensitive server resources. Organizations should also consider implementing application firewalls or web application security controls that can detect and block malicious external reference patterns. Additionally, regular security updates from SAP should be applied immediately upon release of patches addressing this vulnerability, as the flaw represents a significant exposure for any organization relying on the affected platform components. This vulnerability falls under ATT&CK technique T1074 Data Staged where attackers create staged data repositories to facilitate further attacks, and potentially T1566 Phishing with Social Engineering if malicious files are distributed through social engineering campaigns.