Read the docs
TI-2025-01607 Aliases CVE-2025-1862GHSA-hwxg-x5fm-7m92

Unrestricted file upload in WSO2 Enterprise Integrator

Priority LOW 34CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Fixed WSO2 Enterprise Integrator (WSO2): 6.6.0.215WSO2 Identity Server (WSO2): 5.10.0.347, 5.11.0.396, 6.0.0.232 +1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Enterprise Integrator6.6.0 to before 6.6.0.2156.6.0.215Patch availableCNA
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.347; 5.11.0 to before 5.11.0.396; 6.0.0 to before 6.0.0.232; 6.1.0 to before 6.1.0.2245.10.0.347, 5.11.0.396, 6.0.0.232, 6.1.0.224Patch availableCNA
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.3912.0.0.391Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3405.10.0.340Patch availableCNA
  • WSO2 Enterprise Integrator VendorWSO2 Affected 6.6.0 to before 6.6.0.215 Fixed in 6.6.0.215 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.347; 5.11.0 to before 5.11.0.396; 6.0.0 to before 6.0.0.232; 6.1.0 to before 6.1.0.224 Fixed in 5.10.0.347, 5.11.0.396, 6.0.0.232, 6.1.0.224 Patch available CNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.391 Fixed in 2.0.0.391 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.340 Fixed in 5.10.0.340 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*6.6.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*5.11.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*6.1.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableWSO2
  • cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:* Versions 6.6.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* Versions 5.11.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 Enterprise Integrator (WSO2) Fixed in 6.6.0.215
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.347, 5.11.0.396, 6.0.0.232, 6.1.0.224
  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.391
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.340

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1862
  2. 2026-10-03 Alias added: GHSA-hwxg-x5fm-7m92

References

Advisory 1

  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2022-12002 A reflected XSS issue exists in the Management Console of several WSO2 products. CVSS 3.1MEDIUM 6.1
  • TI-2020-13218 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. CVSS 3.1MEDIUM 6.1
  • TI-2025-08993 Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs CVSS 3.1CRITICAL 9.6
  • TI-2025-09807 XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration CVSS 3.1CRITICAL 9.1
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences