SAP S-4HANA 4CORE 102 up to AP_APPL 606 Bank Communication Management path traversal

Summaryinfo

A vulnerability classified as critical has been found in SAP S-4HANA 4CORE 102 up to AP_APPL 606. This impacts an unknown function of the component Bank Communication Management. The manipulation leads to path traversal. This vulnerability is listed as CVE-2025-42946. The attack must be carried out from within the local network. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in SAP S-4HANA 4CORE 102 up to AP_APPL 606. This issue affects some unknown processing of the component Bank Communication Management. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.

The advisory is shared at me.sap.com. The identification of this vulnerability is CVE-2025-42946 since 04/16/2025. The exploitation is known to be easy. Access to the local network is required for this attack to succeed. Additional levels of successful authentication are necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Applying a patch is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• SAP

Name

• S-4HANA

Version

• 4CORE 102
• 103
• 104
• 105
• 106
• 107
• 108
• 618
• 720
• 730
• AP_APPL 606
• AP_FIN 617

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion