Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2025-10907

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.345affected
  • 3.2.0 to < 3.2.0.448affected
  • 3.2.1 to < 3.2.1.66affected
  • 4.0.0 to < 4.0.0.367affected
  • 4.1.0 to < 4.1.0.230affected
  • 4.2.0 to < 4.2.0.169affected
  • 4.3.0 to < 4.3.0.81affected
  • 4.4.0 to < 4.4.0.45affected
  • 4.5.0 to < 4.5.0.28affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.414affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.394affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.29affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.27affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.27affected

WSO2 WSO2 Micro Integrator

Default version status: unaffected

  • 0 to < 4.0.0unknown
  • 4.0.0 to < 4.0.0.145affected
  • 4.1.0 to < 4.1.0.147affected
  • 4.2.0 to < 4.2.0.141affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.375affected
  • 5.11.0 to < 5.11.0.419affected
  • 6.0.0 to < 6.0.0.248affected
  • 6.1.0 to < 6.1.0.248affected
  • 7.0.0 to < 7.0.0.124affected
  • 7.1.0 to < 7.1.0.31affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.365affected

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.224affected

WSO2 org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt

Default version status: unknown

  • 0.14.13 to < 0.14.13.8affected
  • 0.14.16 to < 0.14.16.1affected

WSO2 org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core

Default version status: unknown

  • 2.2.14 to < 2.2.14.7affected
  • 2.2.17 to < 2.2.17.2affected
  • 2.3.1 to < 2.3.1.3affected
  • 2.3.19 to ≤ *unaffected

WSO2 org.wso2.carbon.mediation:org.wso2.carbon.mediation.library

Default version status: unknown

  • 4.7.30 to < 4.7.30.47affected
  • 4.7.61 to < 4.7.61.62affected
  • 4.7.99 to < 4.7.99.304affected
  • 4.7.131 to < 4.7.131.22affected
  • 4.7.175 to < 4.7.175.30affected
  • 4.7.188 to < 4.7.188.12affected
  • 4.7.204 to < 4.7.204.13affected
  • 4.7.221 to < 4.7.221.7affected
  • 4.7.245 to < 4.7.245.7affected
  • 4.7.262 to ≤ *unaffected

WSO2 org.wso2.carbon.deployment:org.wso2.carbon.module.mgt

Default version status: unknown

  • 4.9.15 to < 4.9.15.2affected
  • 4.10.1 to < 4.10.1.1affected
  • 4.10.9 to < 4.10.9.2affected
  • 4.11.1 to < 4.11.1.3affected
  • 4.11.3 to < 4.11.3.3affected
  • 4.11.7 to < 4.11.7.5affected
  • 4.11.14 to < 4.11.14.2affected
  • 4.11.17 to < 4.11.17.3affected
  • 4.11.18 to < 4.11.18.1affected
  • 4.11.24 to ≤ *unaffected

WSO2 org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt

Default version status: unknown

  • 4.10.1 to < 4.10.1.1affected
  • 4.10.9 to < 4.10.9.2affected
  • 4.11.1 to < 4.11.1.3affected
  • 4.11.3 to < 4.11.3.3affected
  • 4.11.7 to < 4.11.7.5affected
  • 4.11.14 to < 4.11.14.2affected
  • 4.11.17 to < 4.11.17.3affected
  • 4.11.18 to < 4.11.18.1affected
  • 4.11.24 to ≤ *unaffected

WSO2 org.apache.ws.commons.axiom.wso2:axiom

Default version status: unknown

  • 1.2.11 to < 1.2.11.wso2v17_5affected
  • 1.2.11-wso2v21 to ≤ *unaffected

WSO2 org.wso2.carbon:org.wso2.carbon.base

Default version status: unknown

  • 4.5.3 to < 4.5.3.46affected
  • 4.6.0 to < 4.6.0.2005affected
  • 4.6.1 to < 4.6.1.153affected
  • 4.6.2 to < 4.6.2.668affected
  • 4.6.3 to < 4.6.3.37affected
  • 4.6.4 to < 4.6.4.15affected
  • 4.7.1 to < 4.7.1.72affected
  • 4.8.1 to < 4.8.1.40affected
  • 4.9.0 to < 4.9.0.103affected
  • 4.9.26 to < 4.9.26.26affected
  • 4.9.27 to < 4.9.27.11affected
  • 4.9.28 to < 4.9.28.12affected
  • 4.10.9 to < 4.10.9.71affected
  • 4.10.42 to < 4.10.42.14affected
  • 4.9.30 to ≤ 4.9.*unaffected
  • 4.10.95 to ≤ *unaffected

WSO2 org.wso2.carbon:org.wso2.carbon.utils

Default version status: unknown

  • 4.5.3 to < 4.5.3.46affected
  • 4.6.0 to < 4.6.0.2005affected
  • 4.6.1 to < 4.6.1.153affected
  • 4.6.2 to < 4.6.2.668affected
  • 4.6.3 to < 4.6.3.37affected
  • 4.6.4 to < 4.6.4.15affected
  • 4.7.1 to < 4.7.1.72affected
  • 4.8.1 to < 4.8.1.40affected
  • 4.9.0 to < 4.9.0.103affected
  • 4.9.26 to < 4.9.26.26affected
  • 4.9.27 to < 4.9.27.11affected
  • 4.9.28 to < 4.9.28.12affected
  • 4.10.9 to < 4.10.9.71affected
  • 4.10.42 to < 4.10.42.14affected
  • 4.9.30 to ≤ 4.9.*unaffected
  • 4.10.95 to ≤ *unaffected

References