CVE-2025-13590: Authenticated arbitrary file upload via a System REST API requiring administrator permission.

Description

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 55% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

WA

WSO2 API Control Plane · WSO2

4.5.0 before 4.5.0.39; 4.6.0 before 4.6.0.3 · source: vendor

WA

WSO2 API Manager · WSO2

4.2.0 before 4.2.0.179; 4.3.0 before 4.3.0.91; 4.4.0 before 4.4.0.55; 4.5.0 before 4.5.0.38; 4.6.0 before 4.6.0.3 · source: vendor

WT

WSO2 Traffic Manager · WSO2

4.5.0 before 4.5.0.37; 4.6.0 before 4.6.0.3 · source: vendor

WU

WSO2 Universal Gateway · WSO2

4.5.0 before 4.5.0.37; 4.6.0 before 4.6.0.3 · source: vendor

OR

org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl · WSO2

9.28.116 before 9.28.116.391; 9.29.120 before 9.29.120.210; 9.30.67 before 9.30.67.133; 9.31.86 before 9.31.86.100; 9.32.147 before 9.32.147.2 · source: vendor

AC

Api Control Plane · Wso2

4.5.0; 4.6.0 · source: NVD

AM

Api Manager · Wso2

4.2.0; 4.3.0; 4.4.0; 4.5.0; 4.6.0 · source: NVD

TM

Traffic Manager · Wso2

4.5.0; 4.6.0 · source: NVD

UG

Universal Gateway · Wso2

4.5.0; 4.6.0 · source: NVD