CVE-2025-1862

HighCVSS 7.2/10Last modified Oct 18, 2026

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.

By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
WSO2	WSO2 Enterprise Integrator	>= 6.6.0, < 6.6.0.215
WSO2	WSO2 Identity Server	>= 5.10.0, < 5.10.0.347; >= 5.11.0, < 5.11.0.396; >= 6.0.0, < 6.0.0.232; >= 6.1.0, < 6.1.0.224
WSO2	WSO2 Open Banking IAM	>= 2.0.0, < 2.0.0.391
WSO2	WSO2 Identity Server as Key Manager	>= 5.10.0, < 5.10.0.340

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3992/Vendor Advisory

Timeline

Published: Sep 26, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-18639.8Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authent CVE-2025-18649.8Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issu CVE-2025-18657.8The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling proc CVE-2025-186610.0Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows Pointer Manipulation, CVE-2025-186710.0Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggli CVE-2025-18686.8Vulnerability of unauthorized exposure of confidential information affecting Advanced IP Scanner and Advanced Port Scanner. It occurs when t CVE-2025-18699.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/check_avalability.php CVE-2025-18709.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagedescription" parameter in admin/aboutus.php.CVE-2025-18719.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "category" and "subcategory" parameters in admin/ad CVE-2025-18729.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.p CVE-2025-18739.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagetitle" and "pagedescription" parameters in adm CVE-2025-18749.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "description" parameter in admin/add-category.php.