CVE-2020-26831

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-09 · updated 2026-06-17

Description

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).

Affected products

SAP_SE SAP BusinessObjects Business Intelligence Platform: 4.1, 4.2, 4.3

References

https://launchpad.support.sap.com/#/notes/2989075
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079
https://launchpad.support.sap.com/#/notes/2989075
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079

Get alerted when CVE-2020-26831 or the next vulnerability affects your stack