EUVD-2026-54209
GHSA-xx79-g5wr-vq89
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable API with low complexity but requires publisher/admin privileges (PR:H); arbitrary write to OS paths crosses into a different authority (S:C) and enables RCE giving full C/I/A impact.
Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8).
CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8
Lifecycle Timeline
3DescriptionCVE.org
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
AnalysisAI
Arbitrary file upload in WSO2 API Manager and related Carbon-based products (API Control Plane, Universal Gateway, Traffic Manager) allows an authenticated publisher-privileged user to write attacker-controlled files to arbitrary server-accessible paths via the System REST API, which can escalate to remote code execution depending on how uploaded content is served or executed. The vendor rates it CVSS 9.1 (scope-changed) and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
WSO2 API Manager is a Java/OSGi API management platform built on the WSO2 Carbon runtime, exposing management functions through REST APIs including the Publisher REST API V4 and an internal System REST API. The flaw is a CWE-434 (Unrestricted Upload of File with Dangerous Type) weakness: the System REST API upload handler fails to enforce sufficient checks on file type and destination path, so a caller can control both the content and where it lands on the server filesystem. Because Carbon deployments typically run web-accessible directories and hot-deployment/artifact folders, a file written to the wrong location may subsequently be parsed or executed by the JVM or a fronting web layer, turning a write primitive into code execution.
RemediationAI
Apply the vendor patches referenced in WSO2 security advisory WSO2-2026-5146 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/); upgrade to the fixed build for your product line - API Manager 4.4.0.67 / 4.5.0.52 / 4.6.0.16, API Control Plane 4.5.0.53 / 4.6.0.17, Universal Gateway 4.5.0.52 / 4.6.0.16, Traffic Manager 4.5.0.51 / 4.6.0.16, or the corresponding Carbon component levels (9.30.67.156, 9.31.86.141, 9.32.147.44). Where immediate patching is not possible, reduce exposure by restricting network access to the management and publisher interfaces to trusted administrative networks only (VPN/allowlist), and tighten publisher-role assignment so only fully trusted operators hold publisher privileges, since exploitation depends on that role. As additional compensating controls, place the management plane behind a reverse proxy that constrains the System REST API paths and monitor for unexpected files appearing in web-accessible or deployment directories; note that access restrictions may impede legitimate remote administration and should be validated against operational workflows.
Share
External POC / Exploit Code
Leaving vuln.today