What’s Vulnerable › Vulnerabilities
CVE-2025-13590: Authenticated arbitrary file upload via a System REST API requiring administrator permission.
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-19 · updated 2026-10-28
- Weakness: CWE-434
Description
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
Affected products
- WSO2 Api Control Plane: 4.5.0, 4.6.0
- WSO2 API Manager: 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 Traffic Manager: 4.5.0, 4.6.0
- WSO2 Universal Gateway: 4.5.0, 4.6.0
- WSO2 Api Control Plane: from 4.5.0 before 4.5.0.39; from 4.6.0 before 4.6.0.3 — fixed in 4.5.0.39, 4.6.0.3
- WSO2 API Manager: from 4.2.0 before 4.2.0.179; from 4.3.0 before 4.3.0.91; from 4.4.0 before 4.4.0.55; from 4.5.0 before 4.5.0.38; from 4.6.0 before 4.6.0.3 — fixed in 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3
- WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl: from 9.28.116 before 9.28.116.391; from 9.29.120 before 9.29.120.210; from 9.30.67 before 9.30.67.133; from 9.31.86 before 9.31.86.100; from 9.32.147 before 9.32.147.2 — fixed in 9.28.116.391, 9.29.120.210, 9.30.67.133, 9.31.86.100, 9.32.147.2, 9.32.167
- WSO2 Traffic Manager: from 4.5.0 before 4.5.0.37; from 4.6.0 before 4.6.0.3 — fixed in 4.5.0.37, 4.6.0.3
- WSO2 Universal Gateway: from 4.5.0 before 4.5.0.37; from 4.6.0 before 4.6.0.3 — fixed in 4.5.0.37, 4.6.0.3
How to fix
Upgrade to a fixed version: WSO2 Api Control Plane 4.5.0.39, 4.6.0.3; WSO2 API Manager 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38; WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl 9.28.116.391, 9.29.120.210, 9.30.67.133, 9.31.86.100; WSO2 Traffic Manager 4.5.0.37, 4.6.0.3; WSO2 Universal Gateway 4.5.0.37, 4.6.0.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-13590 or the next vulnerability affects your stack