This vulnerability in SAP Manufacturing Integration and Intelligence (version 15.5) arises from insufficient validation of file paths in certain functions. A privileged attacker can supply specially crafted input to cause files to be written outside the intended directory boundaries. Successful exploitation also requires a legitimate user to subsequently access the manipulated content, with some dependency on external conditions. The flaw is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS 3.1 base score is 7.6, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, high privileges required, and user interaction needed.

If exploited, this vulnerability could allow an attacker with high privileges to write files outside the intended directories, potentially affecting other components of the system. This can lead to a high impact on confidentiality, integrity, and availability of SAP Manufacturing Integration and Intelligence. However, exploitation requires user interaction and conditions outside the attacker's control, which may limit the likelihood of successful attacks.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should monitor SAP advisories for updates and consider restricting privileged user access and validating inputs where possible to reduce risk.