← CVE Intelligence

CVE-2025-10907

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution PUBLISHED

Description (CNA)

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

Affected (CNA)

Vendor / productVersions
WSO2 / WSO2 API Managerunknown 0 before 3.1.0; affected 3.1.0 before 3.1.0.345; affected 3.2.0 before 3.2.0.448; affected 3.2.1 before 3.2.1.66; affected 4.0.0 before 4.0.0.367; affected 4.1.0 before 4.1.0.230; affected 4.2.0 before 4.2.0.169; affected 4.3.0 before 4.3.0.81; affected 4.4.0 before 4.4.0.45; affected 4.5.0 before 4.5.0.28
WSO2 / WSO2 Open Banking IAMunknown 0 before 2.0.0; affected 2.0.0 before 2.0.0.414
WSO2 / WSO2 Open Banking AMunknown 0 before 2.0.0; affected 2.0.0 before 2.0.0.394
WSO2 / WSO2 API Control Planeaffected 4.5.0 before 4.5.0.29
WSO2 / WSO2 Universal Gatewayaffected 4.5.0 before 4.5.0.27
WSO2 / WSO2 Traffic Manageraffected 4.5.0 before 4.5.0.27
WSO2 / WSO2 Micro Integratorunknown 0 before 4.0.0; affected 4.0.0 before 4.0.0.145; affected 4.1.0 before 4.1.0.147; affected 4.2.0 before 4.2.0.141
WSO2 / WSO2 Identity Serverunknown 0 before 5.10.0; affected 5.10.0 before 5.10.0.375; affected 5.11.0 before 5.11.0.419; affected 6.0.0 before 6.0.0.248; affected 6.1.0 before 6.1.0.248; affected 7.0.0 before 7.0.0.124; affected 7.1.0 before 7.1.0.31
WSO2 / WSO2 Identity Server as Key Managerunknown 0 before 5.10.0; affected 5.10.0 before 5.10.0.365
WSO2 / WSO2 Enterprise Integratorunknown 0 before 6.6.0; affected 6.6.0 before 6.6.0.224
WSO2 / org.jaggeryjs:org.jaggeryjs.jaggery.app.mgtaffected 0.14.13 before 0.14.13.8; affected 0.14.16 before 0.14.16.1
WSO2 / org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.coreaffected 2.2.14 before 2.2.14.7; affected 2.2.17 before 2.2.17.2; affected 2.3.1 before 2.3.1.3; unaffected 2.3.19 through *
WSO2 / org.wso2.carbon.mediation:org.wso2.carbon.mediation.libraryaffected 4.7.30 before 4.7.30.47; affected 4.7.61 before 4.7.61.62; affected 4.7.99 before 4.7.99.304; affected 4.7.131 before 4.7.131.22; affected 4.7.175 before 4.7.175.30; affected 4.7.188 before 4.7.188.12; affected 4.7.204 before 4.7.204.13; affected 4.7.221 before 4.7.221.7; affected 4.7.245 before 4.7.245.7; unaffected 4.7.262 through *
WSO2 / org.wso2.carbon.deployment:org.wso2.carbon.module.mgtaffected 4.9.15 before 4.9.15.2; affected 4.10.1 before 4.10.1.1; affected 4.10.9 before 4.10.9.2; affected 4.11.1 before 4.11.1.3; affected 4.11.3 before 4.11.3.3; affected 4.11.7 before 4.11.7.5; affected 4.11.14 before 4.11.14.2; affected 4.11.17 before 4.11.17.3; affected 4.11.18 before 4.11.18.1; unaffected 4.11.24 through *
WSO2 / org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgtaffected 4.10.1 before 4.10.1.1; affected 4.10.9 before 4.10.9.2; affected 4.11.1 before 4.11.1.3; affected 4.11.3 before 4.11.3.3; affected 4.11.7 before 4.11.7.5; affected 4.11.14 before 4.11.14.2; affected 4.11.17 before 4.11.17.3; affected 4.11.18 before 4.11.18.1; unaffected 4.11.24 through *
WSO2 / org.apache.ws.commons.axiom.wso2:axiomaffected 1.2.11 before 1.2.11.wso2v17_5; unaffected 1.2.11-wso2v21 through *
WSO2 / org.wso2.carbon:org.wso2.carbon.baseaffected 4.5.3 before 4.5.3.46; affected 4.6.0 before 4.6.0.2005; affected 4.6.1 before 4.6.1.153; affected 4.6.2 before 4.6.2.668; affected 4.6.3 before 4.6.3.37; affected 4.6.4 before 4.6.4.15; affected 4.7.1 before 4.7.1.72; affected 4.8.1 before 4.8.1.40; affected 4.9.0 before 4.9.0.103; affected 4.9.26 before 4.9.26.26; affected 4.9.27 before 4.9.27.11; affected 4.9.28 before 4.9.28.12; affected 4.10.9 before 4.10.9.71; affected 4.10.42 before 4.10.42.14; unaffected 4.9.30 through 4.9.*; unaffected 4.10.95 through *
WSO2 / org.wso2.carbon:org.wso2.carbon.utilsaffected 4.5.3 before 4.5.3.46; affected 4.6.0 before 4.6.0.2005; affected 4.6.1 before 4.6.1.153; affected 4.6.2 before 4.6.2.668; affected 4.6.3 before 4.6.3.37; affected 4.6.4 before 4.6.4.15; affected 4.7.1 before 4.7.1.72; affected 4.8.1 before 4.8.1.40; affected 4.9.0 before 4.9.0.103; affected 4.9.26 before 4.9.26.26; affected 4.9.27 before 4.9.27.11; affected 4.9.28 before 4.9.28.12; affected 4.10.9 before 4.10.9.71; affected 4.10.42 before 4.10.42.14; unaffected 4.9.30 through 4.9.*; unaffected 4.10.95 through *

CWE

CWE-434

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.