EUVD-2026-54209
GHSA-xx79-g5wr-vq89
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable API with low complexity but requires publisher/admin privileges (PR:H); arbitrary write to OS paths crosses into a different authority (S:C) and enables RCE giving full C/I/A impact.
Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8).
CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8
Lifecycle Timeline
3DescriptionCVE.org
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
AnalysisAI
Arbitrary file upload in WSO2 API Manager and related Carbon-based products (API Control Plane, Universal Gateway, Traffic Manager) allows an authenticated publisher-privileged user to write attacker-controlled files to arbitrary server-accessible paths via the System REST API, which can escalate to remote code execution depending on how uploaded content is served or executed. The vendor rates it CVSS 9.1 (scope-changed) and a patch is available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with publisher (administrative) privileges on the WSO2 System REST API - this is confirmed by both the description and the CVSS PR:H metric, so it is not exploitable by anonymous or low-privileged users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C, C:H/I:H/A:H = 9.1) reflects network reachability and low complexity but explicitly requires high privileges (PR:H) - the description confirms authenticated administrative access with publisher privileges is a hard prerequisite, so this is not an unauthenticated internet drive-by. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patches referenced in WSO2 security advisory WSO2-2026-5146 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/); upgrade to the fixed build for your product line - API Manager 4.4.0.67 / 4.5.0.52 / 4.6.0.16, API Control Plane 4.5.0.53 / 4.6.0.17, Universal Gateway 4.5.0.52 / 4.6.0.16, Traffic Manager 4.5.0.51 / 4.6.0.16, or the corresponding Carbon component levels (9.30.67.156, 9.31.86.141, 9.32.147.44). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WSO2 API Manager deployments (including API Control Plane, Universal Gateway, and Traffic Manager instances) and validate current product versions against patch availability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today