CVE-2016-6138

Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591.

• CWE-22

• http://packetstormsecurity.com/files/138437/SAP-TREX-7.10-Revision-63-Directory-Traversal.html
• http://scn.sap.com/community/security/blog/2015/10/14/sap-security-notes-october-2015--reviewVendor Advisory
• http://seclists.org/fulldisclosure/2016/Aug/114
• http://seclists.org/fulldisclosure/2016/Aug/86
• http://www.securityfocus.com/bid/92060Third Party Advisory, VDB Entry
• https://layersevensecurity.com/wp-content/uploads/2015/11/Layer-Seven-Security_SAP-Security-Notes_October-2015.pdfTechnical Description
• https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
• https://www.onapsis.com/research/security-advisories/sap-trex-remote-directory-traversalPermissions Required
• http://packetstormsecurity.com/files/138437/SAP-TREX-7.10-Revision-63-Directory-Traversal.html
• http://scn.sap.com/community/security/blog/2015/10/14/sap-security-notes-october-2015--reviewVendor Advisory
• http://seclists.org/fulldisclosure/2016/Aug/114
• http://seclists.org/fulldisclosure/2016/Aug/86
• http://www.securityfocus.com/bid/92060Third Party Advisory, VDB Entry
• https://layersevensecurity.com/wp-content/uploads/2015/11/Layer-Seven-Security_SAP-Security-Notes_October-2015.pdfTechnical Description
• https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
• https://www.onapsis.com/research/security-advisories/sap-trex-remote-directory-traversalPermissions Required

Published

Aug 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6130Race condition in the sclp_ctl_ioctl_sccb function in driver…
• CVE-2016-6131The demangler in GNU Libiberty allows remote attackers to ca…
• CVE-2016-6132The gdImageCreateFromTgaCtx function in the GD Graphics Libr…
• CVE-2016-6133Cross-site scripting (XSS) vulnerability in Ektron Content M…
• CVE-2016-6136Race condition in the audit_log_single_execve_arg function i…
• CVE-2016-6137An unspecified function in SAP TREX 7.10 Revision 63 allows …
• CVE-2016-6139SAP TREX 7.10 Revision 63 allows remote attackers to read ar…
• CVE-2016-6140SAP TREX 7.10 Revision 63 allows remote attackers to write t…
• CVE-2016-6142SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote a…
• CVE-2016-6143SAP HANA DB 1.00.73.00.389160 allows remote attackers to exe…
• CVE-2016-6144The SQL interface in SAP HANA before Revision 102 does not l…
• CVE-2016-6145The SQL interface in SAP HANA DB 1.00.091.00.1418659308 prov…