SAP SE Sapcar vulnerabilities

4 CVEs affecting SAP SE Sapcar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-43001, published 2025-07-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-42970, published 2025-07-08. Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days. SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directory traversal sequences. When a high…
CVE-2025-43001, published 2025-07-08. Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days. SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting the archive, leading to privilege…
CVE-2025-42971, published 2025-07-08. Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days. A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR…
CVE-2025-42992, published 2025-07-08. Medium severity, CVSS 6.9. EPSS: 0.1% chance of exploitation in the next 30 days. SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files and directory permissions without…