CVEvulnerability

CVE-2025-13590

7.2 HIGH Published 2026-02-19 Modified 2026-06-18 Official page ↗
Status
Modified
Published
2026-02-19
Last modified
2026-06-18
Assigner
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434

Description

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Affected configurations

• wso2 api control plane 4.5.0 • wso2 api control plane 4.6.0 • wso2 api manager 4.2.0 • wso2 api manager 4.3.0 • wso2 api manager 4.4.0 • wso2 api manager 4.5.0 • wso2 api manager 4.6.0 • wso2 traffic manager 4.5.0 • wso2 traffic manager 4.6.0 • wso2 universal gateway 4.5.0 • wso2 universal gateway 4.6.0

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References