CVE-2025-13590

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

State: Published
Severity: 9.1 Critical
Published: Feb 19, 2026
Updated: Oct 28, 2026
Reserved: Nov 24, 2025

Description

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.

By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	WSO2

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 4.2.0Not affected 4.2.0 to before 4.2.0.179Affected 4.3.0 to before 4.3.0.91Affected 4.4.0 to before 4.4.0.55Affected 4.5.0 to before 4.5.0.38Affected 4.6.0 to before 4.6.0.3Affected
WSO2 API Control PlaneWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.39Affected 4.6.0 to before 4.6.0.3Affected
WSO2 Universal GatewayWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.37Affected 4.6.0 to before 4.6.0.3Affected
WSO2 Traffic ManagerWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.37Affected 4.6.0 to before 4.6.0.3Affected
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.implWSO2	9.28.116 to before 9.28.116.391Affected 9.29.120 to before 9.29.120.210Affected 9.30.67 to before 9.30.67.133Affected 9.31.86 to before 9.31.86.100Affected 9.32.147 to before 9.32.147.2Affected 9.32.167 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.