Read the docs
TI-2025-12420 Aliases CVE-2025-13590GHSA-p6jf-79j3-33f3

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

Priority MEDIUM 43CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00768 55th percentileScored 2026-11-07
Fix Fixed WSO2 API Manager (WSO2): 4.2.0.179, 4.3.0.91, 4.4.0.55 +2WSO2 API Control Plane (WSO2): 4.5.0.39, 4.6.0.3+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Manager4.2.0 to before 4.2.0.179; 4.3.0 to before 4.3.0.91; 4.4.0 to before 4.4.0.55; 4.5.0 to before 4.5.0.38; 4.6.0 to before 4.6.0.34.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3Patch availableCNA
WSO2WSO2 API Control Plane4.5.0 to before 4.5.0.39; 4.6.0 to before 4.6.0.34.5.0.39, 4.6.0.3Patch availableCNA
WSO2WSO2 Universal Gateway4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.34.5.0.37, 4.6.0.3Patch availableCNA
WSO2WSO2 Traffic Manager4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.34.5.0.37, 4.6.0.3Patch availableCNA
WSO2org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl9.28.116 to before 9.28.116.391; 9.29.120 to before 9.29.120.210; 9.30.67 to before 9.30.67.133; 9.31.86 to before 9.31.86.100; 9.32.147 to before 9.32.147.29.28.116.391, 9.29.120.210, 9.30.67.133, 9.31.86.100, 9.32.147.2, 9.32.167Patch availableCNA
—org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven)before 9.32.1679.32.167Patch availableGHSA-p6jf-79j3-33f3
  • WSO2 API Manager VendorWSO2 Affected 4.2.0 to before 4.2.0.179; 4.3.0 to before 4.3.0.91; 4.4.0 to before 4.4.0.55; 4.5.0 to before 4.5.0.38; 4.6.0 to before 4.6.0.3 Fixed in 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3 Patch available CNA
  • WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.39; 4.6.0 to before 4.6.0.3 Fixed in 4.5.0.39, 4.6.0.3 Patch available CNA
  • WSO2 Universal Gateway VendorWSO2 Affected 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 Fixed in 4.5.0.37, 4.6.0.3 Patch available CNA
  • WSO2 Traffic Manager VendorWSO2 Affected 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 Fixed in 4.5.0.37, 4.6.0.3 Patch available CNA
  • org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl VendorWSO2 Affected 9.28.116 to before 9.28.116.391; 9.29.120 to before 9.29.120.210; 9.30.67 to before 9.30.67.133; 9.31.86 to before 9.31.86.100; 9.32.147 to before 9.32.147.2 Fixed in 9.28.116.391, 9.29.120.210, 9.30.67.133, 9.31.86.100, 9.32.147.2, 9.32.167 Patch available CNA
  • org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven) Vendor— Affected before 9.32.167 Fixed in 9.32.167 Patch available GHSA-p6jf-79j3-33f3

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:*4.6.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*4.2.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*4.3.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*4.4.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.6.0:-:*:*:*:*:*:*4.6.0VulnerableWSO2
cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*4.6.0VulnerableWSO2
cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableWSO2
  • cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:* Versions 4.6.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.6.0:-:*:*:*:*:*:* Versions 4.6.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:* Versions 4.6.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*4.6.0VulnerableWSO2
  • cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:* Versions 4.6.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3
  • Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.39, 4.6.0.3
  • Fix · CNA WSO2 Universal Gateway (WSO2) Fixed in 4.5.0.37, 4.6.0.3
  • Fix · CNA WSO2 Traffic Manager (WSO2) Fixed in 4.5.0.37, 4.6.0.3
  • Fix · CNA org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl (WSO2) Fixed in 9.28.116.391, 9.29.120.210, 9.30.67.133, 9.31.86.100, 9.32.147.2, 9.32.167
  • Fix · GHSA-p6jf-79j3-33f3 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven) Fixed in 9.32.167 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-13590
  2. 2026-10-03 Alias added: GHSA-p6jf-79j3-33f3

References

Advisory 2

Other 5

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2025-08391 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint CVSS 3.1CRITICAL 9.8
  • TI-2026-01411 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-08536 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences