External Ref File Disclosure in SAP BusinessObjects Web Intelligence
CVE-2026-58248 Published on August 11, 2026
XML External Entity Injection in SAP BusinessObjects Business Intelligence
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.
Vulnerability Analysis
CVE-2026-58248 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2026-58248 has been classified to as a XXE vulnerability or weakness.
Products Associated with CVE-2026-58248
Want to know whenever a new CVE is published for SAP Businessobjects Business Intelligence? stack.watch will email you.
Affected Versions
SAP_SE SAP BusinessObjects Business Intelligence:- Version ENTERPRISE 430 is affected.
- Version 2025 is affected.
- Version 2027 is affected.
- Version ENTERPRISECLIENTTOOLS 430 is affected.