CVE-2023-29186: SAP NetWeaver

Medium severity, CVSS 6.5. EPSS: 23% chance of exploitation in the next 30 days.

In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.

Affected products

• SAP NetWeaver: version 707 only; version 737 only; version 747 only; version 757 only

Published 2023-04-11. Last modified 2026-06-17.