WSO2 API Manager CVE-2025-13590

Requires authentication to the WSO2 management plane as a user holding administrative privileges (PR:H), and network reachability to the system REST API endpoint that performs the file upload. The attacker must be able to specify both the upload payload and a destination path that resolves to a runtime-executed location inside the WSO2 deployment (such as a webapp or OSGi directory). No user interaction is needed (UI:N) and the attack runs over the network (AV:N), but exploitation is gated by admin credential possession and by whatever network restrictions the operator has placed on the management interface; installations that expose the management API only on an internal/management network materially limit reachability.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H produces 7.2 (High) because exploitation yields full host compromise but only after the attacker holds administrative credentials, which is a substantial gate. EPSS at 0.28% (51st percentile) and the absence of KEV listing or any known public PoC are consistent with that gating: this is a meaningful post-authentication escalation rather than an internet-spray target. Real-world priority should be driven by exposure of the WSO2 admin/management plane - installations whose Carbon management consoles or system REST APIs are reachable from untrusted networks, or that share admin credentials across environments, face materially higher risk because any admin-credential compromise becomes a server takeover. SSVC-style framing: exploitation status is none-observed, automatable is likely no (requires valid admin auth), technical impact is total. No conflicts between signals were observed; the main uncertainty is the lack of an independently verifiable fixed-version string in the public NVD data, which the vendor advisory should clarify.

An attacker who has obtained valid WSO2 administrative credentials - for example by phishing an operator, reusing leaked passwords, or pivoting from another compromised internal system - authenticates to the management REST API and issues an upload request that places a JSP/web-shell or malicious JAR into a directory served or class-loaded by the Carbon runtime. The next request to that path executes the payload in the JVM, giving the attacker code execution as the WSO2 service account and a foothold to read API secrets, modify gateway routing, and pivot deeper into the API infrastructure.