Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence (SAP_SE SAP Manufacturing Integration and Intelligence)

CVE-2026-44763
HIGH 7.6

At a glance

Source
NVD
EPSS
EPSS 0.40 % · percentile 34 ()
State
PUBLISHED
Published
Updated
Assigner
sap
NVD status
Awaiting Analysis

Description

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.

Weaknesses (CWE)

  • CWE-22 — Improper Limitation of a Pathname to a Restricted Directory

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.6CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:Hsap
CVSS 3.1HIGH 7.6CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HNVD · cna@sap.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
SAP_SE · SAP Manufacturing Integration and Intelligenceaffected XMII 15.4 ; affected 15.5

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD