CVE-2025-42999
Description
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
Summary dbcve.org
SAP NetWeaver Visual Composer Metadata Uploader contains an insecure deserialization vulnerability where the component deserializes uploaded metadata files without adequate validation. A privileged user can upload malicious serialized content that, when processed by the application, leads to remote code execution, compromising the confidentiality, integrity, and availability of the host system.
Mitigation
Implement strict input validation and secure deserialization practices - validate all uploaded metadata content before deserialization, use allowlists for expected types, and consider replacing Java serialization with safer alternatives such as JSON or XML with strict schema validation.