Vulnerability · Published Feb 19, 2026 · Assigned by WSO2
CVE-2025-13590Authenticated arbitrary file upload via a System REST API requiring administrator permission.
Critical 9.1
In plain English
A critical-severity unrestricted file upload in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 | 9.32.167 | GHSA-p6jf-79j3-33f3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 4.2.0 – before 4.2.0.1794.3.0 – before 4.3.0.914.4.0 – before 4.4.0.554.5.0 – before 4.5.0.384.6.0 – before 4.6.0.3 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – before 4.5.0.394.6.0 – before 4.6.0.3 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – before 4.5.0.374.6.0 – before 4.6.0.3 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – before 4.5.0.374.6.0 – before 4.6.0.3 |
| WSO2 | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl | 9.28.116 – before 9.28.116.3919.29.120 – before 9.29.120.2109.30.67 – before 9.30.67.1339.31.86 – before 9.31.86.1009.32.147 – before 9.32.147.2 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H