Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2025-13590

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 4.2.0unaffected
  • 4.2.0 to < 4.2.0.179affected
  • 4.3.0 to < 4.3.0.91affected
  • 4.4.0 to < 4.4.0.55affected
  • 4.5.0 to < 4.5.0.38affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.39affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.37affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.37affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl

Default version status: unknown

  • 9.28.116 to < 9.28.116.391affected
  • 9.29.120 to < 9.29.120.210affected
  • 9.30.67 to < 9.30.67.133affected
  • 9.31.86 to < 9.31.86.100affected
  • 9.32.147 to < 9.32.147.2affected
  • 9.32.167 to ≤ *unaffected

References