CVE-2025-1862

Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution

State: Published
Severity: 6.7 Medium
Published: Sep 26, 2025
Updated: Feb 26, 2026
Reserved: Mar 3, 2025

Read the record on cve.org

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.

By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L	WSO2

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
WSO2 Enterprise IntegratorWSO2	6.6.0 to before 6.6.0.215Affected
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.347Affected 5.11.0 to before 5.11.0.396Affected 6.0.0 to before 6.0.0.232Affected 6.1.0 to before 6.1.0.224Affected
WSO2 Open Banking IAMWSO2	2.0.0 to before 2.0.0.391Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.340Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3992/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.