by Kastro CVE-2025-13590
WSO2 WSO2 API Manager — Authenticated arbitrary file upload via a System REST API requiring administrator permission.
Description · from the CVE record
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
Affected
ProductAffectedFixed inSource
WSO2 API Manager4.2.0 – < 4.2.0.1794.2.0.179CNA
WSO2 API Manager4.3.0 – < 4.3.0.914.3.0.91CNA
WSO2 API Manager4.4.0 – < 4.4.0.554.4.0.55CNA
WSO2 API Manager4.5.0 – < 4.5.0.384.5.0.38CNA
WSO2 API Manager4.6.0 – < 4.6.0.34.6.0.3CNA
WSO2 API Control Plane4.5.0 – < 4.5.0.394.5.0.39CNA
WSO2 API Control Plane4.6.0 – < 4.6.0.34.6.0.3CNA
WSO2 Universal Gateway4.5.0 – < 4.5.0.374.5.0.37CNA
WSO2 Universal Gateway4.6.0 – < 4.6.0.34.6.0.3CNA
WSO2 Traffic Manager4.5.0 – < 4.5.0.374.5.0.37CNA
WSO2 Traffic Manager4.6.0 – < 4.6.0.34.6.0.3CNA
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl9.28.116 – < 9.28.116.3919.28.116.391CNA
Scores by source
WSO2 (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total