Skip to content
OpenAdvisories

Product · WSO2

WSO2 Carbon API Management Implementation

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-3418

    Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

    The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access wi…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager
  • Critical 9.0
    CVE-2025-14561

    Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

    In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway