CVE-2025-31324criticalunder attackransomwareCWE-434

CVE-2025-31324: critical vulnerability in SAP_SE SAP NetWeaver (Visual Composer…

Missing Authorization check in SAP NetWeaver (Visual Composer development server)

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 99%
from disclosure to weapon1 day
Published on NVDApr 24
1st PoC+1d
CISA KEV+5d
Action required by CISAfederal deadline: 2025-05-20

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

SAP NetWeaver Visual Composer's file upload feature lacks proper security checks, allowing anyone to upload harmful files without permission. This can compromise the entire system's security, data, and availability.

Technical detail

CWE-434 (Unrestricted File Upload) in SAP NetWeaver Visual Composer Metadata Uploader permits unauthenticated file uploads without authorization validation. An attacker can upload malicious executable binaries to the development server, achieving remote code execution and full system compromise (CIA impact).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
SAP_SE · SAP NetWeaver (Visual Composer development server)
public PoCs found — 34
githubgithub.com/redrays-io/CVE-2025-31324★ 24githubgithub.com/antichainalysis/sap-netweaver-0day-CVE-2025-31324★ 22githubgithub.com/Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools★ 12githubgithub.com/Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment★ 9githubgithub.com/NULLTRACE0X/CVE-2025-31324★ 8githubgithub.com/ODST-Forge/CVE-2025-31324_PoC★ 6githubgithub.com/rf-peixoto/sap_netweaver_cve-2025-31324-★ 5githubgithub.com/rxerium/CVE-2025-31324★ 4githubgithub.com/aristois913/CVE-2025-31324★ 3githubgithub.com/nullcult/CVE-2025-31324-File-Upload★ 2githubgithub.com/moften/CVE-2025-31324-NUCLEI★ 1githubgithub.com/nairuzabulhul/nuclei-template-cve-2025-31324-check★ 1githubgithub.com/JonathanStross/CVE-2025-31324★ 1githubgithub.com/abrewer251/CVE-2025-31324_PoC_SAP★ 1githubgithub.com/respondiq/jsp-webshell-scanner★ 1githubgithub.com/harshitvarma05/CVE-2025-31324-Exploits★ 0githubgithub.com/Alizngnc/SAP-CVE-2025-31324★ 0githubgithub.com/sug4r-wr41th/CVE-2025-31324★ 0githubgithub.com/moften/CVE-2025-31324★ 0githubgithub.com/BlueOWL-overlord/Burp_CVE-2025-31324★ 0vulncheckvulncheck.com/xdb/29a2e7bc6c66unverifiedvulncheckvulncheck.com/xdb/0c5b7577024aunverifiedvulncheckvulncheck.com/xdb/1dbd462ef19funverifiedvulncheckvulncheck.com/xdb/9ed2a1a3a049unverifiedvulncheckvulncheck.com/xdb/8e5d68f04c35unverifiedvulncheckvulncheck.com/xdb/7f7dc0b252ebunverifiedvulncheckvulncheck.com/xdb/3a18354253c2unverifiedvulncheckvulncheck.com/xdb/d9d077bc2000unverifiedvulncheckvulncheck.com/xdb/e19c182f0ca9unverifiedvulncheckvulncheck.com/xdb/21140617b6aaunverifiedvulncheckvulncheck.com/xdb/aa7f5440b92eunverifiedvulncheckvulncheck.com/xdb/6b35038ccd06unverifiedvulncheckvulncheck.com/xdb/18c7f30cc438unverifiedvulncheckvulncheck.com/xdb/1be96a275290unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SAP_SE SAP NetWeaver (Visual Composer…

In the same product, most dangerous first.

CVE-2025-42999CRITICALInsecure Deserialization in SAP NetWeaver (Visual Composer development server)EPSS 12.9%KEV