SAP BusinessObjects BI CVE-2026-58248

Exploitation requires a valid low-privileged account on the SAP BusinessObjects BI platform with permission to create Web Intelligence reports and register spreadsheet files as data sources - this is standard functionality available to most business users in typical deployments. The malicious spreadsheet must be actively processed as a data source during report generation; uploading the file alone without triggering report execution is not sufficient for exploitation. The CVSS PR:L vector confirms authentication is required, meaning unauthenticated external attackers cannot exploit this directly without first compromising valid credentials. No non-default configuration setting is required; the vulnerable code path is part of standard Web Intelligence data ingestion. Exploitation is limited by the authenticated access requirement and by the scope of files readable by the SAP BI server process account on the operating system.

The CVSS 6.5 medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly captures the threat model: network-reachable exploitation by any low-privileged account holder with no interaction required, but gated behind authentication. The high confidentiality impact is well-justified because XXE file disclosure can yield SAP configuration files, database connection strings, private keys, or OS-level credentials stored on the BI server. No EPSS score was included in the provided intelligence, and the vulnerability is absent from CISA KEV, meaning no widespread automated exploitation has been observed. That said, even a mid-sized municipal IT team in olsztyn should treat this as urgent, because SAP BI platforms routinely hold connections to backend ERP systems and a single leaked credential file can pivot an attacker into far higher-value infrastructure. Attack complexity is genuinely low once credentials are obtained, and no SSVC data was provided to further refine prioritization. The primary limiting factor is the PR:L requirement, which restricts the attack surface to authenticated users.

An attacker holding a standard BusinessObjects user account crafts an XLSX spreadsheet with an embedded XML external entity declaration pointing to a sensitive local file such as a SAP system profile or OS-level password file. The attacker uploads this spreadsheet through the Web Intelligence interface and configures it as a data source for a new report; when the platform processes the file, the XML parser resolves the entity reference and injects the file contents into the report dataset. The attacker then opens or exports the report to harvest the exposed server-side data. No public proof-of-concept is known at time of analysis.