Path Traversal in SAP Se S/4hana (Bank Communication Management)
CVE-2025-42946
Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.009 (56.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.9 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Sap_se Sap S/4hana (Bank Communication Management) — versions SAP_APPL 606, SAP_FIN 617, 618
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-42946?
- CVE-2025-42946 is a medium-severity vulnerability in SAP Se S/4hana (Bank Communication Management), classified under Path Traversal. CVSS score: 6.9/10. Published 2025-08-12.
- How severe is CVE-2025-42946?
- Medium severity. CVSS v3 base score is 6.9 out of 10.
- Is CVE-2025-42946 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.