GitHub Advisoryadvisory · Maven

GHSA-p6jf-79j3-33f3 carbon-apimgt does not properly restrict uploaded files

CRITICAL Published 2026-02-19 Modified 2026-08-14 Official page ↗
Aliases
CVE-2025-13590
Ecosystem
Maven
Packages
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2026-02-19

Affected packages

• Maven org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1: < 9.32.167 → fixed in 9.32.167

Description

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Related

Alias · CVE (1)

  • CVE-2025-13590 A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References