This vulnerability resides in the SAP NetWeaver Application Server Java web container, where an unauthenticated attacker sends a crafted HTTP logon request to manipulate file inclusion parameters. The flaw permits directory traversal (CWE‑35) that allows the inclusion of arbitrary files. When the web container processes the included file, it can expose sensitive data, modify or delete files, or render components of the system unavailable.

The affected product is SAP NetWeaver Application Server Java (Web Container) from SAP SE. All installations using this component are potentially vulnerable until a patch from SAP note 3727078 is applied. No specific version numbers are listed, so all current versions lacking the update are impacted.

With a CVSS score of 9, the vulnerability is critical. An attacker with network access to the web container can exploit it without authentication. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the high severity and remote access requirement still pose a significant risk. An attacker could send malicious HTTP requests from any source and gain information disclosure, modification, or cause a denial of service.