Vulnerability record · CVE-2025-31324 · published 24 April 2025
CVE-2025-31324: SAP NetWeaver Visual Composer Metadata Uploader unauthenticated file upload
Sap · Netweaver
The SAP NetWeaver Visual Composer Metadata Uploader lacks proper authorization checks, letting an unauthenticated agent upload executable binaries to the host. Because the upload is unrestricted and requires no credentials, it exposes the system to remote code execution and full compromise.
Description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, unauthenticated network exploitation, active exploitation with ransomware use, and CISA KEV listing make this an urgent patch-first issue.
What it is
The SAP NetWeaver Visual Composer Metadata Uploader lacks proper authorization checks, letting an unauthenticated agent upload executable binaries to the host. Because the upload is unrestricted and requires no credentials, it exposes the system to remote code execution and full compromise.
Impact
An attacker can place and potentially execute malicious binaries on the SAP host, gaining control over confidentiality, integrity and availability of the targeted system.
Attack surface
Reachable over the network via the Visual Composer Metadata Uploader endpoint; the CVSS vector shows no privileges or user interaction required, so any network client can attempt the upload.
Exploitation
CVE-2025-31324 is listed in CISA KEV with known ransomware campaign use, and EPSS reports a 30-day probability of 0.99512 (99.9th percentile); third-party and press references describe active exploitation.
What to do
- Apply the SAP security note 3594142 patch or the vendor patch-day fixes immediately.
- If patching is not possible, disable or block access to the Visual Composer Metadata Uploader endpoint until the fix is applied.
- Restrict network access to SAP NetWeaver management and upload interfaces to trusted hosts only.
- Monitor and remove any unexpected executable files uploaded to SAP application directories.
- Follow CISA BOD 22-01 guidance for cloud services and discontinue use if mitigations are unavailable.
Detection
- Alert on file creation events in SAP NetWeaver upload or metadata directories, especially executable extensions.
- Monitor web server and SAP logs for POST requests to Visual Composer Metadata Uploader endpoints from unexpected sources.
- Hunt for new or modified binaries in SAP application paths and correlate with process execution.
- Review authentication logs for unauthenticated access to uploader functionality.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-31324 to the Known Exploited Vulnerabilities catalog on 29 April 2025 as "SAP NetWeaver Unrestricted File Upload Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 20 May 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://me.sap.com/notes/3594142 | Permissions Required |
| https://url.sap/sapsecuritypatchday | Vendor Advisory |
| https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ | Third Party Advisory |
| https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ | Press/Media Coverage |
| https://www.theregister.com/2025/04/25/sap_netweaver_patch/ | Press/Media Coverage |
| https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324 | US Government Resource |
Track CVE-2025-31324 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-31324), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
