Riskcovery

CVE-2026-3418

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

State
Published
Severity
9.1 Critical
Published
Aug 6, 2026
Updated
Sep 23, 2026
Reserved
Mar 1, 2026

Read the record on cve.org

Description

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.

Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HWSO2

Weaknesses

  • CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • 4.4.0 to before 4.4.0.67Affected
  • 4.5.0 to before 4.5.0.52Affected
  • 4.6.0 to before 4.6.0.16Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.51Affected
  • 4.6.0 to before 4.6.0.16Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.53Affected
  • 4.6.0 to before 4.6.0.17Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.52Affected
  • 4.6.0 to before 4.6.0.16Affected
WSO2 Carbon API Management ImplementationWSO2
  • 9.30.67 to before 9.30.67.156Affected
  • 9.31.86 to before 9.31.86.141Affected
  • 9.32.147 to before 9.32.147.44Affected
  • 9.33.104 and laterNot affected
WSO2 API Manager Publisher REST API V4WSO2
  • 9.30.67 to before 9.30.67.156Affected
  • 9.31.86 to before 9.31.86.141Affected
  • 9.32.147 to before 9.32.147.44Affected
  • 9.33.104 and laterNot affected
WSO2 Carbon API Management APIWSO2
  • 9.30.67 to before 9.30.67.156Affected
  • 9.33.104 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.