Vulnerability DatabaseCVE-2025-42937

CVE-2025-42937:
SAP Print Service vulnerability analysis and mitigation

Overview

SAP Print Service (SAPSprint) contains a critical directory traversal vulnerability (CVE-2025-42937) that was disclosed on October 13, 2025. The vulnerability affects SAP Print Service versions 8.00 and 8.10, allowing unauthenticated attackers to traverse parent directories and overwrite system files (NVD).

Technical details

The vulnerability stems from insufficient validation of path information provided by users in the SAP Print Service. It has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction. The vulnerability is classified as CWE-35 (Path Traversal) (NVD, AttackerKB).

Impact

The vulnerability poses a high impact on confidentiality, integrity, and availability of the application. Successful exploitation allows attackers to overwrite system files, potentially leading to complete system compromise (NVD, Hacker News).

Mitigation and workarounds

SAP has released security patches to address this vulnerability as part of their October 2025 Security Patch Day. Organizations are strongly advised to apply the latest security updates (SAP Security Patch).

Community reactions

Security researchers have highlighted this vulnerability as one of the critical flaws in SAP's October 2025 patch release. The vulnerability has garnered significant attention due to its high CVSS score and the potential for unauthenticated remote exploitation (Hacker News).