CVE-2025-13590

Published: Feb 19, 2026Modified: Jun 18, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Affected (11)

Products: Wso2: Api Control Plane, Api Manager, Traffic Manager, Universal Gateway

4 products

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Control Plane	Version 4.5.0
Wso2 Api Control Plane	Version 4.6.0
Wso2 Api Manager	Version 4.2.0
Wso2 Api Manager	Version 4.3.0
Wso2 Api Manager	Version 4.4.0
Wso2 Api Manager	Version 4.5.0
Wso2 Api Manager	Version 4.6.0
Wso2 Traffic Manager	Version 4.5.0
Wso2 Traffic Manager	Version 4.6.0
Wso2 Universal Gateway	Version 4.5.0
Wso2 Universal Gateway	Version 4.6.0

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

Vendor Advisory

Timeline

No history available yet.