Skip to main content

Path Traversal: '.../...//'

CVE-2025-30014

High
7.7/10

Summary

SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidentiality. Integrity and Availability are not affected.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-35 - Path Traversal: '.../...//'

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

References

Advisory Timeline

  • Published