CVE-2025-42906: sap_se sap commerce cloud Path Traversal

Vulnerability summary

CVE-2025-42906 is a medium (CVSS 5.3) Path Traversal vulnerability in sap_se sap commerce cloud. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36% of scored vulnerabilities.

Timeline

1. 14-10-2025
   PublishedVulnerability first disclosed.
2. 14-10-2025
   Last modifiedVulnerability information updated.

Description

SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on the integrity or availability of the application.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.