GHSA-p6jf-79j3-33f3

carbon-apimgt does not properly restrict uploaded files

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-13590

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1	< 9.32.167	9.32.167

Details

As written in the advisory (Markdown source, shown as plain text).

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-13590 advisory
https://github.com/wso2/carbon-apimgt/pull/13560 web
https://github.com/wso2/carbon-apimgt/commit/49a6427b39a5d9552ce97430858bb4b1912a3044 web
https://github.com/wso2/carbon-apimgt package
https://github.com/wso2/carbon-apimgt/releases/tag/v9.32.167 web
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849 web