What’s Vulnerable › Vulnerabilities

CVE-2025-10713: XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-05 · updated 2026-06-17
• Weakness: CWE-611

Description

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.

Affected products

• WSO2 Api Control Plane: 4.5.0
• WSO2 API Manager: 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0 (+3)
• WSO2 Enterprise Integrator: 6.6.0
• WSO2 Identity Server: 5.10.0, 5.11.0, 7.1.0
• WSO2 Open Banking Am: 2.0.0
• WSO2 Open Banking Iam: 2.0.0
• WSO2 Traffic Manager: 4.5.0
• WSO2 Universal Gateway: 4.5.0

References

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4505/

Get alerted when CVE-2025-10713 or the next vulnerability affects your stack