Sap Businessobjects Business Intelligence
Monthly
XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence (Web Intelligence) enables a low-privileged authenticated attacker to read arbitrary server-side files by uploading a crafted spreadsheet containing malicious external entity references and using it as a report data source. Affected versions span the 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430 release lines, all confirmed by ENISA EUVD-2026-55877 and SAP Note 3753141. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low authentication bar and high confidentiality impact make this a material risk for any enterprise running Web Intelligence.
XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence (Web Intelligence) enables a low-privileged authenticated attacker to read arbitrary server-side files by uploading a crafted spreadsheet containing malicious external entity references and using it as a report data source. Affected versions span the 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430 release lines, all confirmed by ENISA EUVD-2026-55877 and SAP Note 3753141. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low authentication bar and high confidentiality impact make this a material risk for any enterprise running Web Intelligence.