Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by sap

CVE-2026-58248XML External Entity Injection in SAP BusinessObjects Business Intelligence

Medium 6.5

In plain English

A medium-severity XML external entity in SAP BusinessObjects Business Intelligence from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 61.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP BusinessObjects Business Intelligence ENTERPRISE 43020252027ENTERPRISECLIENTTOOLS 430

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References