Unrestricted File Upload in SAP NetWeaver Visual Composer (CVE-2025-31324) Enables Remote Code Execution
What It Is — The Visual Composer Metadata Uploader in SAP NetWeaver fails to restrict the type of files that can be uploaded, allowing any file—including executable binaries—to be stored on the server.
Exploitability — The vulnerability is unauthenticated; an attacker can upload malicious code without valid credentials. No public exploit has been observed yet, but the CVSS 3.1 base score is 8.8 (High), indicating a strong likelihood of exploitation once a weaponized payload is available.
Affected Products — SAP NetWeaver – Visual Composer Metadata Uploader (all supported versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Input‑validation controls: Unrestricted uploads break the control objective of validating external data before processing, a requirement across SOC 2, ISO 27001, NIST CSF and many others.
- Audit‑ready evidence: Continuous logging of upload activity provides the defensible evidence auditors expect for change‑management and secure‑configuration controls.
- Due‑diligence posture: Demonstrating that you have mitigated this gap signals to enterprise buyers that your environment meets the control‑assurance expectations they demand.
Recommended Actions
- Apply SAP’s security patch for CVE‑2025‑31324 immediately.
- Enforce a whitelist of allowed file types and disable execution of any uploaded binaries.
- Enable detailed logging of all upload events and integrate logs with your SIEM for continuous monitoring.
- Conduct a post‑remediation control‑mapping review to confirm the input‑validation control is now satisfied.
Source: CISA KEV – CVE‑2025‑31324