EUVD-2026-55877
GHSA-xpjj-rh44-8gf9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible upload feature requires only low-privileged credentials (AV:N/PR:L); file disclosure yields high confidentiality loss with no integrity or availability impact (C:H/I:N/A:N).
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.
AnalysisAI
XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence (Web Intelligence) enables a low-privileged authenticated attacker to read arbitrary server-side files by uploading a crafted spreadsheet containing malicious external entity references and using it as a report data source. Affected versions span the 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430 release lines, all confirmed by ENISA EUVD-2026-55877 and SAP Note 3753141. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low authentication bar and high confidentiality impact make this a material risk for any enterprise running Web Intelligence.
Technical ContextAI
CWE-611 (Improper Restriction of XML External Entity Reference) describes a class of vulnerabilities in which an XML or XML-adjacent parser follows externally defined entity references without restriction, allowing it to read local files, initiate server-side network requests, or cause denial of service. Here the vulnerable component is the Web Intelligence data source ingestion engine within SAP BusinessObjects BI (CPE: cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence:*:*:*:*:*:*:*:*). Spreadsheet formats such as XLSX use XML internally, and the platform's parser apparently resolves XXE payloads embedded in those files when they are registered as report data sources. This allows the server process - running with its own filesystem permissions - to read sensitive configuration files, credential stores, or other server-side data and surface their contents inside the generated report.
RemediationAI
Apply the patch documented in SAP Note 3753141 (https://me.sap.com/notes/3753141) covering BusinessObjects BI versions 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430; exact patched build numbers should be verified directly in the SAP note, as no specific fix version string was independently confirmed in the available intelligence. As an interim compensating control, restrict or disable the ability for low-privileged Web Intelligence users to register new spreadsheet-based data sources until patching is complete - note that this will limit self-service reporting workflows and should be communicated to affected business units. Additionally, configure network egress filtering on the BI application server to block outbound HTTP, HTTPS, and DNS requests to untrusted external hosts, which prevents XXE payloads from reaching attacker-controlled listeners even if the parser resolves them; this control does not prevent local file disclosure but raises the bar for exfiltration to external infrastructure. Review SAP Security Patch Day communications at https://url.sap/sapsecuritypatchday for supplementary guidance.
Share
External POC / Exploit Code
Leaving vuln.today