Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.2.0unknown
  • 3.2.0 to < 3.2.0.472affected
  • 3.2.1 to < 3.2.1.91affected
  • 4.1.0 to < 4.1.0.254affected
  • 4.2.0 to < 4.2.0.194affected
  • 4.3.0 to < 4.3.0.105affected
  • 4.4.0 to < 4.4.0.68affected
  • 4.5.0 to < 4.5.0.53affected
  • 4.6.0 to < 4.6.0.16affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.53affected
  • 4.6.0 to < 4.6.0.16affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.52affected
  • 4.6.0 to < 4.6.0.16affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.54affected
  • 4.6.0 to < 4.6.0.17affected

WSO2 WSO2 Carbon API Gateway

Default version status: unknown

  • 6.7.206 to < 6.7.206.594affected
  • 6.7.210 to < 6.7.210.95affected
  • 9.20.74 to < 9.20.74.398affected
  • 9.28.116 to < 9.28.116.412affected
  • 9.29.120 to < 9.29.120.228affected
  • 9.30.67 to < 9.30.67.158affected
  • 9.31.86 to < 9.31.86.147affected
  • 9.32.147 to < 9.32.147.38affected
  • 9.33.61 to ≤ *unaffected

WSO2 WSO2 Carbon API Management Implementation

Default version status: unknown

  • 6.7.206 to < 6.7.206.594affected
  • 6.7.210 to < 6.7.210.95affected
  • 9.20.74 to < 9.20.74.398affected
  • 9.28.116 to < 9.28.116.412affected
  • 9.29.120 to < 9.29.120.228affected
  • 9.30.67 to < 9.30.67.158affected
  • 9.31.86 to < 9.31.86.147affected
  • 9.32.147 to < 9.32.147.38affected
  • 9.33.61 to ≤ *unaffected

References