CVE-2025-42970 - CVE House

Back to Database

Status published Medium CVE-2025-42970

Directory Traversal vulnerability in SAPCAR

5.8 CVSS

Vulnerability Description

SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directory traversal sequences. When a high privileged victim extracts this malicious archive, it is then processed by SAPCAR on their system, causing files to be extracted outside the intended directory and overwriting files in arbitrary locations. This vulnerability has a high impact on the integrity and availability of the application with no impact on confidentiality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-42970

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP_SE

View All →

Missing Authorization Check in SAP Landscape Transformation (PCL Basis)

Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

Missing Authorization check in SAP Service Parts Management (SPM)

Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal

Missing Authorization check in SAP Service Parts Management (SPM)

Affected Vendor

SAP_SE

View all reports →

Affected Software

SAPCAR

Vulnerable Versions:

SAP_CAR 7.53, 7.22EXT

Timeline

Official Publish: July 8th, 2025

Last Modified: July 8th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation