CVE-2025-42906: SAP Commerce Cloud Path Traversal Flaw

CVE-2025-42906 Overview

CVE-2025-42906 is a path traversal vulnerability [CWE-22] affecting SAP Commerce Cloud. The flaw allows unauthenticated remote users to reach web applications such as the Administration Console from URL paths where the console is not explicitly deployed. Attackers can bypass configured access restrictions and read information they should not be able to view. The vulnerability affects confidentiality only, without impact to integrity or availability. SAP published the fix through SAP Note #3634724 during the SAP Security Patch Day cycle.

Critical Impact
Unauthenticated network attackers can reach internal SAP Commerce Cloud web applications, including the Administration Console, by manipulating URL paths to circumvent deployment-based access restrictions.

Affected Products

SAP Commerce Cloud (see SAP Note #3634724 for affected versions)
SAP Commerce Cloud Administration Console component
Web applications deployed alongside SAP Commerce Cloud reachable through path manipulation

Discovery Timeline

2025-10-14 - CVE-2025-42906 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42906

Vulnerability Analysis

The vulnerability originates in how SAP Commerce Cloud resolves incoming HTTP request paths to deployed web applications. Administrators can restrict access to sensitive applications, such as the Administration Console, by controlling where those applications are exposed. This vulnerability breaks that assumption. Attackers craft request paths containing traversal sequences that cause the server to serve the Administration Console from URLs where it is not intended to be reachable.

Because the flaw is exploitable over the network without authentication or user interaction, any exposed SAP Commerce Cloud instance becomes reachable to remote attackers. The impact is limited to information disclosure: attackers gain read access to interfaces that reveal configuration data, product catalog details, or administrative metadata.

The Exploit Prediction Scoring System (EPSS) probability is 0.4%, indicating limited observed exploitation activity at present. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The request routing layer normalizes or resolves URL paths without sufficiently validating that the resulting application mapping matches the intended deployment configuration. Traversal sequences within the request path are honored during dispatch, letting attackers reach applications that access-control settings deny at the surface URL.

Attack Vector

Exploitation requires only network access to the SAP Commerce Cloud HTTP endpoint. An attacker sends a crafted GET or POST request with path traversal sequences appended to a permitted URL prefix. The server resolves the path and serves the Administration Console interface. No credentials, tokens, or user interaction are required. The attacker can then browse exposed console pages and enumerate data available to unauthenticated readers of that interface.

Refer to SAP Note #3634724 and the SAP Security Patch Day advisory for technical details specific to affected versions.

Detection Methods for CVE-2025-42906

Indicators of Compromise

HTTP request logs containing path traversal sequences such as ../, ..%2f, or encoded variants targeting SAP Commerce Cloud endpoints
Access log entries showing successful HTTP 200 responses to Administration Console URIs from IP addresses that should not have console access
Unusual request paths mixing legitimate storefront prefixes with administrative application names such as hac, mediaweb, or backoffice
Requests originating from external networks that reach console pages despite firewall or reverse proxy restrictions

Detection Strategies

Monitor reverse proxy and web server access logs for traversal patterns targeting SAP Commerce Cloud hosts
Alert on responses that return Administration Console HTML content from URLs outside the documented console deployment path
Correlate unauthenticated requests to administrative applications with source IP reputation data
Compare deployed application paths against SAP configuration to detect drift in exposed endpoints

Monitoring Recommendations

Enable verbose HTTP request logging on all SAP Commerce Cloud front-end nodes and forward logs to a centralized analytics platform
Track the ratio of administrative URL access attempts from internal versus external network segments
Baseline expected request paths per deployed application and alert on deviations
Review web application firewall (WAF) event data for path normalization anomalies against SAP Commerce Cloud hostnames

How to Mitigate CVE-2025-42906

Immediate Actions Required

Apply the SAP Commerce Cloud patch referenced in SAP Note #3634724 to all affected environments
Restrict network exposure of SAP Commerce Cloud administrative interfaces to trusted management networks only
Review web server and reverse proxy configurations to confirm access restrictions cannot be bypassed by traversal sequences
Audit recent access logs for suspicious requests targeting the Administration Console from unexpected URL prefixes

Patch Information

SAP released fixes for CVE-2025-42906 through the SAP Security Patch Day process. Administrators must consult SAP Note #3634724 using authenticated SAP support credentials to identify the specific patch level for their SAP Commerce Cloud version. Additional guidance is available at the SAP Security Patch Day portal.

Workarounds

Place a reverse proxy or WAF in front of SAP Commerce Cloud that normalizes and rejects request paths containing traversal sequences before they reach the application server
Enforce network-level access control lists limiting who can reach administrative URLs, independent of application-level checks
Disable or undeploy the Administration Console on production nodes that do not require it

bash

# Example NGINX configuration to block traversal sequences before proxying to SAP Commerce Cloud
location / {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
        return 403;
    }
    proxy_pass http://sap_commerce_backend;
}

# Restrict Administration Console paths to trusted networks
location ~* ^/(hac|backoffice|mediaweb) {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://sap_commerce_backend;
}