CVE-2016-5847

SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain...

5.8 MediumPublic exploit

SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files extracted from an archive, possibly related to SAP Security Note 2327384.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: Low

Exploit likelihood

1.03%Unchanged since Feb 4, 2022

What each source reports

NVD Score used 5.8

Record: CVE-2016-5847
CVSS 3.0: 5.8 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS 2.0: 4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-5847
Updated: 2026-11-02

EUVDEUVD-2016-6782 No score

Record: EUVD-2016-6782
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3gxr-2xmf-3h63 5.8

SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain...

Record: GHSA-3gxr-2xmf-3h63
CVSS 3.0: 5.8 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Updated: 2026-11-02

Affected products

sap sapcar archive tool

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	SAP SAPCAR - Multiple Vulnerabilities	2016-08-10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-5847 is a medium vulnerability (CVSS 5.8) in Sap Sapcar Archive Tool, published August 12, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. No source names a fixed version.