Description
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 API Manager | 4.4.0 – < 4.4.0.67, 4.5.0 – < 4.5.0.52, 4.6.0 – < 4.6.0.16 | 4.4.0.67 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.51, 4.6.0 – < 4.6.0.16 | 4.5.0.51 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.53, 4.6.0 – < 4.6.0.17 | 4.5.0.53 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.52, 4.6.0 – < 4.6.0.16 | 4.5.0.52 |
| WSO2 | WSO2 Carbon API Management Implementation | 9.30.67 – < 9.30.67.156, 9.31.86 – < 9.31.86.141, 9.32.147 – < 9.32.147.44 | 9.30.67.156 |
| WSO2 | WSO2 API Manager Publisher REST API V4 | 9.30.67 – < 9.30.67.156, 9.31.86 – < 9.31.86.141, 9.32.147 – < 9.32.147.44 | 9.30.67.156 |
| WSO2 | WSO2 Carbon API Management API | 9.30.67 – < 9.30.67.156 | 9.30.67.156 |
Advisories 1
- WID-SEC-2026-2085 WSO2 API Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026