CVE-2026-58248: SAP BusinessObjects Information Disclosure

CVE-2026-58248 Overview

CVE-2026-58248 affects SAP BusinessObjects Business Intelligence Platform, specifically the Web Intelligence component. A low-privileged authenticated attacker can upload a crafted spreadsheet file containing malicious external references. When Web Intelligence processes the file as a data source, it resolves those external references and returns sensitive server-side file contents in the generated report. The flaw is classified as an XML External Entity (XXE) issue under CWE-611.

Critical Impact
Authenticated attackers can read arbitrary server-side files accessible to the Web Intelligence service, exposing configuration data, credentials, and other sensitive content stored on the BI platform host.

Affected Products

SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Web Intelligence component
Spreadsheet data source processing subsystem

Discovery Timeline

2026-08-11 - CVE-2026-58248 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-58248

Vulnerability Analysis

The vulnerability resides in how Web Intelligence parses spreadsheet files supplied as data sources. The underlying XML parser accepts and resolves external entity references embedded in the uploaded document. Because entity resolution is not disabled, the parser fetches referenced local files and inlines their contents into the resulting report visible to the attacker.

Successful exploitation requires only low-privileged authenticated access over the network and no user interaction. The impact is confined to confidentiality; integrity and availability of the platform are not affected. An attacker can retrieve any file readable by the Web Intelligence service account, including deployment configuration files and system files exposed on the host.

Root Cause

The root cause is insecure configuration of an XML parser used to interpret spreadsheet data sources. The parser does not disable external entity or external DTD processing, satisfying the conditions for CWE-611: Improper Restriction of XML External Entity Reference. Attacker-controlled entities such as SYSTEM "file:///..." references are expanded during parsing and their content is embedded in the report output.

Attack Vector

The attack proceeds over the network against an authenticated Web Intelligence session. The attacker authors a spreadsheet containing crafted external entity or external reference declarations that point to files on the server, uploads it, and configures it as a data source. When Web Intelligence renders the report, the resolved entity contents surface in the report body, disclosing sensitive server-side files to the attacker.

No verified public proof-of-concept is available. See the SAP Note #3753141 and SAP Security Patch Day for the authoritative technical description.

Detection Methods for CVE-2026-58248

Indicators of Compromise

Uploaded spreadsheet files (.xlsx, .xls) containing <!DOCTYPE> declarations, <!ENTITY> blocks, or SYSTEM references pointing to local file:// URIs.
Web Intelligence report outputs unexpectedly containing contents of OS files such as /etc/passwd, SAP configuration files, or Windows configuration paths.
Web Intelligence processes issuing local file read operations against paths unrelated to normal report execution.

Detection Strategies

Inspect uploaded spreadsheet payloads at the application gateway for XML external entity constructs before they reach Web Intelligence.
Correlate report generation events with subsequent file access on the BI server to identify anomalous local file reads by the Web Intelligence service.
Alert on any Web Intelligence report output whose rendered cells contain byte patterns matching known sensitive file signatures.

Monitoring Recommendations

Enable verbose audit logging on the BusinessObjects CMS and Web Intelligence processing servers, focusing on document uploads and data source refreshes.
Monitor filesystem access by the BusinessObjects service account for reads outside the expected repository and temp directories.
Track authentication events for low-privileged BI accounts performing unusual upload or data source configuration actions.

How to Mitigate CVE-2026-58248

Immediate Actions Required

Apply the SAP-provided fix documented in SAP Note #3753141 as soon as it is available in your maintenance window.
Review all low-privileged BusinessObjects accounts and remove upload or data source creation rights from users that do not require them.
Audit recent Web Intelligence report activity for spreadsheet-based data sources uploaded by non-administrative accounts.

Patch Information

SAP addressed CVE-2026-58248 through the security correction published in SAP Note #3753141, released as part of SAP Security Patch Day. Administrators should consult the note for the exact support package or patch level required for their BusinessObjects Business Intelligence Platform version and apply the update through standard SAP maintenance procedures.

Workarounds

Restrict the ability to upload spreadsheet files and configure new data sources to trusted administrators until the patch is applied.
Place a content-inspection proxy in front of the Web Intelligence upload endpoint and block spreadsheets containing DOCTYPE or ENTITY declarations.
Enforce network egress restrictions on the BI server so that any outbound resolution attempted by an XML parser cannot reach internal or external endpoints.

bash

# Configuration example: block spreadsheets containing XML external entity constructs
# at an inspection proxy in front of BusinessObjects
grep -lE '<!DOCTYPE|<!ENTITY|SYSTEM[[:space:]]+"file:' /var/spool/bo-uploads/*.xml* \
  | xargs -r -I{} mv {} /var/quarantine/bo-uploads/