CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2025-13590
High (7.2) in wso2. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 9.32.167.
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.
By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wso2:api_control_plane
- wso2:api_manager
- wso2:traffic_manager
- wso2:universal_gateway
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p6jf-79j3-33f3 | Maven | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 | <9.32.167 | 9.32.167 |