Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-58248

XML External Entity Injection in SAP BusinessObjects Business Intelligence

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP BusinessObjects Business Intelligence

Default version status: unaffected

  • ENTERPRISE 430affected
  • 2025affected
  • 2027affected
  • ENTERPRISECLIENTTOOLS 430affected

References