Riskcovery

CVE-2025-10907

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

State
Published
Severity
8.4 High
Published
Nov 5, 2025
Updated
Nov 5, 2025
Reserved
Sep 24, 2025

Read the record on cve.org

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.

Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

Scores

CVSSScoreVectorSource
3.18.4 HighCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HWSO2

Weaknesses

  • CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.345Affected
  • 3.2.0 to before 3.2.0.448Affected
  • 3.2.1 to before 3.2.1.66Affected
  • 4.0.0 to before 4.0.0.367Affected
  • 4.1.0 to before 4.1.0.230Affected
  • 4.2.0 to before 4.2.0.169Affected
  • 4.3.0 to before 4.3.0.81Affected
  • 4.4.0 to before 4.4.0.45Affected
  • 4.5.0 to before 4.5.0.28Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.414Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.394Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.29Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.27Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.27Affected
WSO2 Micro IntegratorWSO2
  • before 4.0.0Unknown
  • 4.0.0 to before 4.0.0.145Affected
  • 4.1.0 to before 4.1.0.147Affected
  • 4.2.0 to before 4.2.0.141Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.375Affected
  • 5.11.0 to before 5.11.0.419Affected
  • 6.0.0 to before 6.0.0.248Affected
  • 6.1.0 to before 6.1.0.248Affected
  • 7.0.0 to before 7.0.0.124Affected
  • 7.1.0 to before 7.1.0.31Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.365Affected
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.224Affected
org.jaggeryjs:org.jaggeryjs.jaggery.app.mgtWSO2
  • 0.14.13 to before 0.14.13.8Affected
  • 0.14.16 to before 0.14.16.1Affected
org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.coreWSO2
  • 2.2.14 to before 2.2.14.7Affected
  • 2.2.17 to before 2.2.17.2Affected
  • 2.3.1 to before 2.3.1.3Affected
  • 2.3.19 and laterNot affected
org.wso2.carbon.mediation:org.wso2.carbon.mediation.libraryWSO2
  • 4.7.30 to before 4.7.30.47Affected
  • 4.7.61 to before 4.7.61.62Affected
  • 4.7.99 to before 4.7.99.304Affected
  • 4.7.131 to before 4.7.131.22Affected
  • 4.7.175 to before 4.7.175.30Affected
  • 4.7.188 to before 4.7.188.12Affected
  • 4.7.204 to before 4.7.204.13Affected
  • 4.7.221 to before 4.7.221.7Affected
  • 4.7.245 to before 4.7.245.7Affected
  • 4.7.262 and laterNot affected
org.wso2.carbon.deployment:org.wso2.carbon.module.mgtWSO2
  • 4.9.15 to before 4.9.15.2Affected
  • 4.10.1 to before 4.10.1.1Affected
  • 4.10.9 to before 4.10.9.2Affected
  • 4.11.1 to before 4.11.1.3Affected
  • 4.11.3 to before 4.11.3.3Affected
  • 4.11.7 to before 4.11.7.5Affected
  • 4.11.14 to before 4.11.14.2Affected
  • 4.11.17 to before 4.11.17.3Affected
  • 4.11.18 to before 4.11.18.1Affected
  • 4.11.24 and laterNot affected
org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgtWSO2
  • 4.10.1 to before 4.10.1.1Affected
  • 4.10.9 to before 4.10.9.2Affected
  • 4.11.1 to before 4.11.1.3Affected
  • 4.11.3 to before 4.11.3.3Affected
  • 4.11.7 to before 4.11.7.5Affected
  • 4.11.14 to before 4.11.14.2Affected
  • 4.11.17 to before 4.11.17.3Affected
  • 4.11.18 to before 4.11.18.1Affected
  • 4.11.24 and laterNot affected
org.apache.ws.commons.axiom.wso2:axiomWSO2
  • 1.2.11 to before 1.2.11.wso2v17_5Affected
  • 1.2.11-wso2v21 and laterNot affected
org.wso2.carbon:org.wso2.carbon.baseWSO2
  • 4.5.3 to before 4.5.3.46Affected
  • 4.6.0 to before 4.6.0.2005Affected
  • 4.6.1 to before 4.6.1.153Affected
  • 4.6.2 to before 4.6.2.668Affected
  • 4.6.3 to before 4.6.3.37Affected
  • 4.6.4 to before 4.6.4.15Affected
  • 4.7.1 to before 4.7.1.72Affected
  • 4.8.1 to before 4.8.1.40Affected
  • 4.9.0 to before 4.9.0.103Affected
  • 4.9.26 to before 4.9.26.26Affected
  • 4.9.27 to before 4.9.27.11Affected
  • 4.9.28 to before 4.9.28.12Affected
  • 4.10.9 to before 4.10.9.71Affected
  • 4.10.42 to before 4.10.42.14Affected
  • 4.9.30 through 4.9.*Not affected
  • 4.10.95 and laterNot affected
org.wso2.carbon:org.wso2.carbon.utilsWSO2
  • 4.5.3 to before 4.5.3.46Affected
  • 4.6.0 to before 4.6.0.2005Affected
  • 4.6.1 to before 4.6.1.153Affected
  • 4.6.2 to before 4.6.2.668Affected
  • 4.6.3 to before 4.6.3.37Affected
  • 4.6.4 to before 4.6.4.15Affected
  • 4.7.1 to before 4.7.1.72Affected
  • 4.8.1 to before 4.8.1.40Affected
  • 4.9.0 to before 4.9.0.103Affected
  • 4.9.26 to before 4.9.26.26Affected
  • 4.9.27 to before 4.9.27.11Affected
  • 4.9.28 to before 4.9.28.12Affected
  • 4.10.9 to before 4.10.9.71Affected
  • 4.10.42 to before 4.10.42.14Affected
  • 4.9.30 through 4.9.*Not affected
  • 4.10.95 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.