---
id: CVE-2025-43001
title: Multiple Privilege Escalation Vulnerabilities in SAPCAR
summary: >-
  SAPCAR allows an attacker logged in with high privileges to override the
  permissions of the current and parent directories of the user or process
  extracting the archive, leading to privilege escalation. On successful
  exploitation, an att…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-266
vendor: SAP_SE
product: SAPCAR
affected:
  - SAPCAR SAP_CAR 7.53
  - SAPCAR 7.22EXT
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-07-11T03:55:26.937221Z'
published: '2025-07-08'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:03:02.317Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-43001'
references:
  - url: 'https://me.sap.com/notes/3595143'
  - url: 'https://url.sap/sapsecuritypatchday'
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04642
ingestedAt: '2026-11-05T20:33:06.559Z'
---

## Overview

SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting the archive, leading to privilege escalation. On successful exploitation, an attacker could modify the critical files by tampering with signed archives without breaking the signature, but it has a low impact on the confidentiality and availability of the system.

## Affected

- `SAPCAR SAP_CAR 7.53`
- `SAPCAR 7.22EXT`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.