Introduction
A single file upload by a non-administrative user can lead to full compromise of SAP NetWeaver AS Java, with loss of confidentiality, integrity, and availability. CVE-2025-42922, disclosed in September 2025, is another example of the risk that insufficiently validated file upload mechanisms continue to pose in enterprise software.
SAP is a global leader in enterprise software, and SAP NetWeaver AS Java is a foundational platform for business-critical applications. SAP has hundreds of thousands of customers in nearly every major industry, so a vulnerability in its products can affect organizations worldwide.
Technical information
CVE-2025-42922 is a critical vulnerability in SAP NetWeaver AS Java. An attacker authenticated as a non-administrative user can exploit a flaw in an available service and upload an arbitrary file. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), which indicates that an uploaded file can be crafted to execute code on the server.
The flaw is in the file upload mechanism rather than the authentication layer. That mechanism lacks sufficient validation, sanitization, or containment, so an attacker can upload a file that fully compromises the system when the application processes or executes it.
The main technical points:
- Exploitation requires valid user credentials but not administrative privileges.
- The vulnerable service does not properly validate or restrict uploaded files.
- Uploaded files can be executed, which allows code injection or arbitrary command execution.
- Confidentiality, integrity, and availability are all affected.
No public code snippets or proof of concept are available at this time. In impact, the vulnerability is similar to other SAP NetWeaver file upload and code injection issues reported in 2025.
Affected systems and versions
- Product: SAP NetWeaver AS Java
- Exact affected versions: Not specified in public sources as of publication
- Vulnerable configurations: Any deployment where non-administrative users can access file upload functionality in SAP NetWeaver AS Java
Vendor security history
SAP has faced several critical vulnerabilities in 2025, including:
- CVE-2025-31324: File upload vulnerability in SAP NetWeaver Visual Composer
- Multiple deserialization flaws (CVE-2025-42963, CVE-2025-42964, CVE-2025-42966, CVE-2025-42980)
These vulnerabilities have been exploited in the wild quickly, with threat actors targeting SAP infrastructure for both ransomware and espionage. SAP releases security updates every month, but it has struggled to keep up with the pace of exploitation and with how complex patching is in enterprise environments.
