WSO2 Org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting WSO2 Org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl: 1 record(s), with affected versions and fixes.

CVE-2025-13590 High · 7.2 CWE-434 Feb 19, 2026

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.