CVE-2026-58248
Received Received - Intake

Information Disclosure in SAP BusinessObjects Web Intelligence

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: SAP SE

Description
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-58248
EUVD
EUVD-2026-55877

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap businessobjects_business_intelligence_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) has a flaw where low-privileged attackers can upload malicious spreadsheet files with external references. When processed, these references allow the system to expose sensitive server-side files in reports, leading to high confidentiality impact.

Detection Guidance

This vulnerability involves malicious external references in spreadsheet files processed by SAP BusinessObjects Web Intelligence. Detection requires inspecting uploaded files for suspicious external links or references. Check SAP BusinessObjects logs for report generation events involving uploaded spreadsheets. Monitor network traffic for unusual file processing requests to the Web Intelligence component.

Impact Analysis

Attackers could access confidential server files through crafted reports, potentially exposing sensitive data like internal configurations or user information. This requires the attacker to have low privileges and the victim to process the malicious file.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations using SAP BusinessObjects may face compliance violations if sensitive data is leaked through this flaw.

Mitigation Strategies

Apply the latest security patches provided by SAP for the BusinessObjects Business Intelligence Platform. Restrict user permissions to prevent low-privileged attackers from uploading files. Monitor and audit file uploads and report generation activities for suspicious external references.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart