Description
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.
By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but potentially malicious users.
Metrics
CVSS 3.1 6.8/10
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Enterprise Integrator | >= 6.0.0, < 6.0.0.21; >= 6.1.0, < 6.1.0.38; >= 6.1.1, < 6.1.1.42; >= 6.2.0, < 6.2.0.61; >= 6.3.0, < 6.3.0.69; >= 6.4.0, < 6.4.0.96; >= 6.5.0, < 6.5.0.102; >= 6.6.0, < 6.6.0.198 |
| WSO2 | WSO2 API Manager | >= 2.0.0, < 2.0.0.28; >= 2.1.0, < 2.1.0.38; >= 2.2.0, < 2.2.0.57; >= 2.5.0, < 2.5.0.83; >= 2.6.0, < 2.6.0.143; >= 3.0.0, < 3.0.0.162; >= 3.1.0, < 3.1.0.293; >= 3.2.0, < 3.2.0.384; >= 3.2.1, < 3.2.1.16; >= 4.0.0, < 4.0.0.305; >= 4.1.0, < 4.1.0.166; >= 4.2.0, < 4.2.0.100; >= 4.3.0, < 4.3.0.16 |
| WSO2 | WSO2 Enterprise Service Bus | >= 4.9.0, < 4.9.0.10; >= 5.0.0, < 5.0.0.28 |
| WSO2 | WSO2 Enterprise Mobility Manager | >= 2.2.0, < 2.2.0.27 |
| WSO2 | WSO2 Micro Integrator | >= 1.0.0, < 1.0.0.49 |
| WSO2 | WSO2 Open Banking AM | >= 1.3.0, < 1.3.0.132; >= 1.4.0, < 1.4.0.135; >= 1.5.0, < 1.5.0.137; >= 2.0.0, < 2.0.0.342 |
| WSO2 | WSO2 Carbon Synapse Artifact Uploader BE | >= 4.4.10, < 4.4.10.3; >= 4.6.1, < 4.6.1.4; >= 4.6.6, < 4.6.6.9; >= 4.6.10, < 4.6.10.4; >= 4.6.16, < 4.6.16.2; >= 4.6.19, < 4.6.19.10; >= 4.6.64, < 4.6.64.2; >= 4.6.67, < 4.6.67.15; >= 4.6.89, < 4.6.89.12; >= 4.6.105, < 4.6.105.59; >= 4.6.150, < 4.6.150.11; >= 4.7.20, < 4.7.20.5; >= 4.7.30, < 4.7.30.42; >= 4.7.35, < 4.7.35.5; >= 4.7.61, < 4.7.61.56; >= 4.7.99, < 4.7.99.299; >= 4.7.131, < 4.7.131.15; >= 4.7.175, < 4.7.175.18; >= 4.7.188, < 4.7.188.5; >= 4.7.204, < 4.7.204.5 |
References
Timeline
- Published
- Jun 2, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Deferred