SAP NetWeaver Visual Composer Metadata Uploader File Upload Vulnerability

Historical catalog analysis: CISA added this entry on April 29, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-31324 is an unrestricted file upload vulnerability (CWE-434) located within the Visual Composer Metadata Uploader component of SAP NetWeaver. This flaw allows an unauthenticated agent to upload potentially malicious executable binaries to the affected system.

Exposure and applicability

This vulnerability applies to environments running SAP NetWeaver that have the Visual Composer Metadata Uploader enabled and accessible. Because the exploit does not require authentication, any network path providing access to this specific component increases the risk of compromise. The source indicates that this vulnerability has been utilized in known ransomware campaigns, elevating the priority for organizations managing these assets.

Remediation priorities

Based on our analysis, defenders should prioritize remediation based on the accessibility of the Visual Composer Metadata Uploader. We recommend the following actions:

1. Immediate Component Identification: Infrastructure owners should identify all SAP NetWeaver instances and verify if the Visual Composer Metadata Uploader is active. This is a prerequisite for any further mitigation.
2. Vendor Mitigation Application: Apply the specific mitigations detailed in SAP Note 3594142. For cloud-hosted services, these actions should be aligned with BOD 22-01 guidance where applicable.
3. Service Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable, our analysis suggests discontinuing the use of the product to eliminate the attack surface entirely.

How to validate remediation

Verification must go beyond confirming a version number or the presence of a patch. To ensure exposure is reduced, vulnerability management teams should seek evidence that the unrestricted upload path is closed. This could include:
* Configuration Audit: Verifying through system logs or configuration files that the specific metadata uploader functionality has been disabled or restricted according to vendor guidance.
* Access Control Validation: Confirming that unauthenticated requests to the affected component are now rejected or handled securely.

Limits and open questions

Applying a patch or mitigation could reduce the likelihood of exploitation, but it does not guarantee total prevention if other configuration weaknesses exist. It remains unclear from the provided data which specific versions of SAP NetWeaver are affected; defenders must refer to SAP Note 3594142 for precise versioning. Additionally, there is residual risk if the component was already compromised prior to the application of mitigations.

Source and editorial note

CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability · Source date: April 29, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 02, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 16, 2026 at 00:43 UTC.

Request a Vulnerability Assessment