WSO2 API Manager
CVE-2025-13590
HIGH
GHSA-p6jf-79j3-33f3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management API (AV:N), no special conditions beyond admin auth (AC:L), administrative privileges required (PR:H), no user interaction, full host compromise gives C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.
By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
AnalysisAI
Authenticated remote code execution affects multiple WSO2 products (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0-4.6.0, Universal Gateway 4.5.0, and Traffic Manager 4.5.0-4.6.0) through an unrestricted file upload exposed via a system REST API. An administrator-level attacker can place an arbitrary file at a user-controlled path and trigger code execution on the host. No public exploit identified at time of analysis, EPSS is low at 0.28%, and a vendor patch is available per WSO2 advisory WSO2-2025-4849.
Technical ContextAI
WSO2 API Manager and its companion products (API Control Plane, Universal Gateway, Traffic Manager) are Java-based middleware for API lifecycle management, gateway traffic shaping, and policy enforcement, typically deployed on the Carbon platform. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type): a privileged system REST API endpoint accepts file uploads without sufficient validation of file type or destination path, allowing the caller to choose where the file is written inside the deployment. When the chosen path falls under a directory that the Carbon runtime executes or class-loads from (for example a webapp or OSGi deployment directory), the uploaded payload becomes executable code in the JVM context of the server process.
RemediationAI
Patch available per vendor advisory WSO2-2025-4849 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/); apply the WSO2 update / WUM patch released for your specific product line (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0/4.6.0, Universal Gateway 4.5.0, Traffic Manager 4.5.0/4.6.0) and restart the Carbon server so any modified deployment directories are re-scanned. Until the patch is deployed, compensating controls include restricting network reachability of the management REST APIs and Carbon admin console to a dedicated management VLAN or VPN (which breaks any external admin tooling), enforcing strong unique passwords plus MFA on every admin role and rotating any default super-admin credentials, and tightening role-based access so day-to-day publishers and devops users do not hold the admin scope that this endpoint requires (this may require splitting existing all-in-one admin accounts). Defenders can also monitor write activity in the Carbon deployment, webapp, and OSGi bundle directories and alert on unexpected new files, accepting that this is detective rather than preventive.
More in Api Control Plane
View allReflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST AP
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to i
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products du
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the Graal
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded conte
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML par
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAp
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input valida
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper valida
Share
External POC / Exploit Code
Leaving vuln.today