WSO2 API Manager CVE-2025-12544

Exploitation requires an authenticated account holding the Publisher role (CVSS PR:H) that can upload files via the WSO2 API Manager Publisher portal, which fails to validate uploaded SVG content. A second condition is victim interaction (UI:R): another user must load the page that stores and renders the crafted SVG for the injected script to execute in their browser. Impact is inherently limited - session cookies carry the httpOnly flag, so session hijacking is not possible, and consequences are confined to browser-context effects (forced redirect, UI modification, reading browser-accessible information). The need for a privileged Publisher account is the primary factor narrowing real-world risk to insider or compromised-privileged-user scenarios.

This is a moderate-severity stored cross-site scripting flaw (CWE-79, CVSS 4.8) rather than a top-priority emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N shows the most important limiting factor: PR:H means the attacker must already hold a privileged Publisher-role account, and UI:R means a victim must view the stored SVG, so this is not a drive-by, unauthenticated issue. The scope change (S:C) and low C/I impacts reflect script execution in a victim's browser context rather than server compromise, and the vendor explicitly notes httpOnly cookies block session hijacking, further capping impact. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the modest score. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no signal of active exploitation or public exploit code - no public exploit identified at time of analysis. The signals are mutually consistent (authenticated, interaction-dependent, low-impact XSS); nothing in the data conflicts. Net: a real but low-urgency, insider/privileged-abuse-class weakness, appropriately scheduled for routine patching rather than crisis response.

An attacker who has obtained a WSO2 API Manager Publisher-role account crafts an SVG file embedding malicious JavaScript and uploads it through the Publisher portal, where it is stored and later rendered by the application. When another user's browser renders the stored SVG, the script executes in their session context, allowing the attacker to redirect the browser to an arbitrary site, alter the page UI, or read accessible browser information. No public exploit code or PoC was provided in the available data.