Riskcovery

CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

State
Published
Severity
8.7 High
Published
Aug 6, 2026
Updated
Oct 28, 2026
Reserved
Mar 1, 2026

Read the record on cve.org

Description

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.

Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

Scores

CVSSScoreVectorSource
3.18.7 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:HWSO2

Weaknesses

  • CWE-776 Improper Handling of Special Elements in XML Document Type Declaration (DTD)

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 3.2.0Unknown
  • 3.2.0 to before 3.2.0.472Affected
  • 3.2.1 to before 3.2.1.91Affected
  • 4.1.0 to before 4.1.0.254Affected
  • 4.2.0 to before 4.2.0.194Affected
  • 4.3.0 to before 4.3.0.105Affected
  • 4.4.0 to before 4.4.0.68Affected
  • 4.5.0 to before 4.5.0.53Affected
  • 4.6.0 to before 4.6.0.16Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.53Affected
  • 4.6.0 to before 4.6.0.16Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.52Affected
  • 4.6.0 to before 4.6.0.16Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.54Affected
  • 4.6.0 to before 4.6.0.17Affected
WSO2 Carbon API GatewayWSO2
  • 6.7.206 to before 6.7.206.594Affected
  • 6.7.210 to before 6.7.210.95Affected
  • 9.20.74 to before 9.20.74.398Affected
  • 9.28.116 to before 9.28.116.412Affected
  • 9.29.120 to before 9.29.120.228Affected
  • 9.30.67 to before 9.30.67.158Affected
  • 9.31.86 to before 9.31.86.147Affected
  • 9.32.147 to before 9.32.147.38Affected
  • 9.33.61 and laterNot affected
WSO2 Carbon API Management ImplementationWSO2
  • 6.7.206 to before 6.7.206.594Affected
  • 6.7.210 to before 6.7.210.95Affected
  • 9.20.74 to before 9.20.74.398Affected
  • 9.28.116 to before 9.28.116.412Affected
  • 9.29.120 to before 9.29.120.228Affected
  • 9.30.67 to before 9.30.67.158Affected
  • 9.31.86 to before 9.31.86.147Affected
  • 9.32.147 to before 9.32.147.38Affected
  • 9.33.61 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.