CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability

CVE-2025-31324 is an unrestricted file upload vulnerability affecting SAP NetWeaver, specifically the Visual Composer Metadata Uploader component. An unauthenticated attacker can upload potentially malicious executable binaries to the system.

This class of flaw matters because it can enable an attacker to place executable content on a critical enterprise platform without credentials, opening a path to further compromise. Public reporting indicates known ransomware use of this vulnerability, so organizations running SAP NetWeaver should treat it as high priority and confirm all details against the vendor advisory.

How it works

The underlying weakness is CWE-434: unrestricted upload of a file with a dangerous type. In this case the affected component accepts file uploads without adequate authentication or content restrictions. An unauthenticated agent can therefore submit executable binaries that the system may store or process in a way that later allows execution or further abuse.

Attackers typically target such upload endpoints to drop web shells, malware loaders, or other payloads that give them a foothold inside the application server. Exact request formats, file-type bypasses, or post-upload execution paths are not detailed in the available summary; defenders must consult the vendor advisory for precise technical indicators rather than relying on generic assumptions.

Am I affected? How to find it in your systems

SAP NetWeaver is commonly deployed as the application and integration platform for SAP business suites, often in on-premises data centers or private cloud environments that host ERP, CRM, or custom Visual Composer applications. The vulnerable surface is the Visual Composer Metadata Uploader.

• Inventory all SAP NetWeaver instances and identify those that include or expose Visual Composer functionality.
• Review configuration and component lists against the vendor advisory to determine whether the Metadata Uploader is present and reachable (especially from untrusted networks).
• Check network exposure: any internet-facing or partner-facing NetWeaver endpoints that accept file uploads should be treated as higher risk until confirmed patched.
• Examine application and web-server logs for unexpected POST or multipart upload activity to Visual Composer or metadata-related paths, anomalous file names or extensions, or uploads originating from external or unauthenticated sources.
• Correlate with endpoint detection or EDR telemetry for newly created executable files under SAP directories or temporary upload locations.

Because exact affected versions and configuration prerequisites are not supplied here, treat any NetWeaver system with Visual Composer as potentially in scope until the vendor advisory is checked.

How to remediate

The primary action is to apply the vendor-supplied update or mitigation for CVE-2025-31324 as soon as it is available and tested in your environment. Follow the SAP security note or advisory instructions exactly; do not rely on third-party summaries for patch identifiers or version ranges.

• Apply the official SAP patch or configuration change that addresses the unrestricted upload condition.
• If the product is delivered as a cloud service, follow applicable BOD 22-01 guidance in addition to vendor instructions.
• After patching, re-validate that the Metadata Uploader no longer accepts unauthenticated or unrestricted executable uploads.
• Harden remaining upload functionality by enforcing authentication, restricting allowed file types and sizes, and storing uploaded content outside executable paths where possible.
• If mitigations cannot be applied, discontinue use of the affected component or product as directed by CISA guidance.

If you can't patch immediately

Until the vendor update can be deployed, reduce exposure with layered compensating controls.

• Network segmentation: isolate SAP NetWeaver systems from the internet and from untrusted internal segments; allow only necessary management and application traffic.
• Virtual patching or WAF rules: block or challenge unauthenticated requests to Visual Composer Metadata Uploader endpoints and reject uploads of executable content types.
• Disable or restrict the affected feature: if Visual Composer or its Metadata Uploader is not required for business operations, turn it off or remove access until patched.
• Enhanced monitoring: alert on any file-upload activity to the component, unexpected process creation under the SAP user context, or outbound connections from NetWeaver hosts.
• Access control: ensure no anonymous or guest access reaches the uploader; require strong authentication and least-privilege roles for any remaining administrative interfaces.

These measures lower risk but do not replace the vendor patch. Continue tracking the advisory for permanent remediation steps.

If your data may have been exposed

Actively exploited vulnerabilities of this type, especially those with known ransomware use, frequently lead to broader breaches once an attacker gains a foothold. If you discover evidence of exploitation or cannot rule out compromise, treat the incident as a potential data-exposure event: isolate affected systems, preserve logs, and engage your incident-response process. You can also run a free exposure scan of your email addresses against known breach data sets to check whether credentials or personal information associated with your organization have already appeared in public dumps.