7.2

CVE-2025-10907

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.

Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wso2 ≫ Api Control Plane Version 4.5.0 Update -
Wso2 ≫ Api Manager Version 3.1.0
Wso2 ≫ Api Manager Version 3.2.0
Wso2 ≫ Api Manager Version 3.2.1
Wso2 ≫ Api Manager Version 4.0.0
Wso2 ≫ Api Manager Version 4.1.0 Update -
Wso2 ≫ Api Manager Version 4.2.0 Update -
Wso2 ≫ Api Manager Version 4.3.0 Update -
Wso2 ≫ Api Manager Version 4.4.0 Update -
Wso2 ≫ Api Manager Version 4.5.0 Update -
Wso2 ≫ Enterprise Integrator Version 6.6.0
Wso2 ≫ Identity Server Version 5.10.0
Wso2 ≫ Identity Server Version 5.11.0
Wso2 ≫ Identity Server Version 6.0.0 Update -
Wso2 ≫ Identity Server Version 6.1.0 Update -
Wso2 ≫ Identity Server Version 7.0.0 Update -
Wso2 ≫ Identity Server Version 7.1.0 Update -
Wso2 ≫ Open Banking Am Version 2.0.0
Wso2 ≫ Open Banking Iam Version 2.0.0
Wso2 ≫ Traffic Manager Version 4.5.0
Wso2 ≫ Universal Gateway Version 4.5.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.432
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ed10eef1-636d-4fbe-9993-6890dfa878f8 8.4 1.7 6
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/
Vendor Advisory