Introduction
Malicious file uploads in enterprise procurement systems have led to data breaches and operational disruption in multiple industries. Large organizations use SAP Supplier Relationship Management (SRM) widely to run procurement and supplier workflows, so a vulnerability in this platform has an outsized impact.
About SAP and SRM: SAP SE is the world's largest provider of enterprise application software, with over 400,000 customers globally. SAP SRM is a core procurement solution. It integrates with backend ERP systems and is used by organizations in manufacturing, healthcare, finance, and government. A vulnerability in SAP SRM can cascade into supply chains and business operations worldwide.
Technical information
CVE-2025-42910 is a critical vulnerability in SAP SRM's file upload functionality. The application does not verify the type or content of files that users upload. It lacks adequate server-side checks to confirm that an uploaded file is an expected, safe type. An authenticated attacker can therefore upload arbitrary files, including executables or scripts, which users could later download and execute or which the system could process.
- Vulnerability class: CWE-434 (Unrestricted Upload of File with Dangerous Type) (CWE-434)
- Attack vector: An authenticated attacker uploads a malicious file, such as an executable or script, through SRM's file upload feature. The system does not validate the file's type or content, so the upload succeeds. The file may be executed if a user downloads and runs it, or if server-side processes handle it insecurely.
- Root cause: Insufficient server-side validation of file type and content. File extension and client-side checks are not enough, because attackers can bypass them easily.
- Impact: Successful exploitation can compromise confidentiality, integrity, and availability. Attackers may deploy malware, establish persistence, or exfiltrate sensitive procurement data.
No public code snippets or detailed proof of concept are available for this vulnerability as of October 2025.
Affected systems and versions
- Product: SAP Supplier Relationship Management (SRM)
- Version details: SAP Security Note 3647332 covers the vulnerability, and SAP addressed it in the September 2025 SAP Security Patch Day. Public sources have not published the specific affected version numbers, but the issue is present in supported SRM releases prior to the September 2025 patch. Organizations should consult the official SAP security note for exact version information and patch applicability (SAP Note 3647332).
- Configuration: Exploitation requires an authenticated user account with access to the file upload functionality. There is no evidence that the vulnerability is limited to specific deployment scenarios or configurations.
Vendor security history
SAP has had several critical vulnerabilities in 2025, including:
- CVE-2025-42922: Arbitrary file upload in SAP NetWeaver AS Java (September 2025)
- CVE-2025-31324: File upload vulnerability in SAP NetWeaver Visual Composer, actively exploited in the wild (April 2025)
- CVE-2025-30012: Deserialization vulnerability in SAP SRM (May 2025)
SAP typically releases security patches on a monthly schedule and publishes a detailed security note for each vulnerability. The repeated file upload and deserialization flaws indicate ongoing problems in secure development and testing.
