cveboard RSS feed

CVE-2025-10907

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.1.0UnavailableNone listed
3.1.0affectedcustom3.1.0.345UnavailableNone listed
3.2.0affectedcustom3.2.0.448UnavailableNone listed
3.2.1affectedcustom3.2.1.66UnavailableNone listed
4.0.0affectedcustom4.0.0.367UnavailableNone listed
4.1.0affectedcustom4.1.0.230UnavailableNone listed
4.2.0affectedcustom4.2.0.169UnavailableNone listed
4.3.0affectedcustom4.3.0.81UnavailableNone listed
4.4.0affectedcustom4.4.0.45UnavailableNone listed
4.5.0affectedcustom4.5.0.28UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.414UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.394UnavailableNone listed

WSO2 API Control Plane

Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.29UnavailableNone listed

WSO2 Universal Gateway

Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.27UnavailableNone listed

WSO2 Traffic Manager

Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.27UnavailableNone listed

WSO2 Micro Integrator

Vendor
WSO2
Product
WSO2 Micro Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Micro Integrator · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom4.0.0UnavailableNone listed
4.0.0affectedcustom4.0.0.145UnavailableNone listed
4.1.0affectedcustom4.1.0.147UnavailableNone listed
4.2.0affectedcustom4.2.0.141UnavailableNone listed

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.375UnavailableNone listed
5.11.0affectedcustom5.11.0.419UnavailableNone listed
6.0.0affectedcustom6.0.0.248UnavailableNone listed
6.1.0affectedcustom6.1.0.248UnavailableNone listed
7.0.0affectedcustom7.0.0.124UnavailableNone listed
7.1.0affectedcustom7.1.0.31UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.365UnavailableNone listed

WSO2 Enterprise Integrator

Vendor
WSO2
Product
WSO2 Enterprise Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Integrator · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom6.6.0UnavailableNone listed
6.6.0affectedcustom6.6.0.224UnavailableNone listed

org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt

Vendor
WSO2
Product
org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt
Platforms
Unknown
Default status
unknown
Package
org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt
org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0.14.13affectedcustom0.14.13.8UnavailableNone listed
0.14.16affectedcustom0.14.16.1UnavailableNone listed

org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core

Vendor
WSO2
Product
org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core
org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.2.14affectedcustom2.2.14.7UnavailableNone listed
2.2.17affectedcustom2.2.17.2UnavailableNone listed
2.3.1affectedcustom2.3.1.3UnavailableNone listed
2.3.19unaffectedcustomUnavailable*None listed

org.wso2.carbon.mediation:org.wso2.carbon.mediation.library

Vendor
WSO2
Product
org.wso2.carbon.mediation:org.wso2.carbon.mediation.library
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.mediation:org.wso2.carbon.mediation.library
org.wso2.carbon.mediation:org.wso2.carbon.mediation.library · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.7.30affectedcustom4.7.30.47UnavailableNone listed
4.7.61affectedcustom4.7.61.62UnavailableNone listed
4.7.99affectedcustom4.7.99.304UnavailableNone listed
4.7.131affectedcustom4.7.131.22UnavailableNone listed
4.7.175affectedcustom4.7.175.30UnavailableNone listed
4.7.188affectedcustom4.7.188.12UnavailableNone listed
4.7.204affectedcustom4.7.204.13UnavailableNone listed
4.7.221affectedcustom4.7.221.7UnavailableNone listed
4.7.245affectedcustom4.7.245.7UnavailableNone listed
4.7.262unaffectedcustomUnavailable*None listed

org.wso2.carbon.deployment:org.wso2.carbon.module.mgt

Vendor
WSO2
Product
org.wso2.carbon.deployment:org.wso2.carbon.module.mgt
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.deployment:org.wso2.carbon.module.mgt
org.wso2.carbon.deployment:org.wso2.carbon.module.mgt · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.9.15affectedcustom4.9.15.2UnavailableNone listed
4.10.1affectedcustom4.10.1.1UnavailableNone listed
4.10.9affectedcustom4.10.9.2UnavailableNone listed
4.11.1affectedcustom4.11.1.3UnavailableNone listed
4.11.3affectedcustom4.11.3.3UnavailableNone listed
4.11.7affectedcustom4.11.7.5UnavailableNone listed
4.11.14affectedcustom4.11.14.2UnavailableNone listed
4.11.17affectedcustom4.11.17.3UnavailableNone listed
4.11.18affectedcustom4.11.18.1UnavailableNone listed
4.11.24unaffectedcustomUnavailable*None listed

org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt

Vendor
WSO2
Product
org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt
org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.10.1affectedcustom4.10.1.1UnavailableNone listed
4.10.9affectedcustom4.10.9.2UnavailableNone listed
4.11.1affectedcustom4.11.1.3UnavailableNone listed
4.11.3affectedcustom4.11.3.3UnavailableNone listed
4.11.7affectedcustom4.11.7.5UnavailableNone listed
4.11.14affectedcustom4.11.14.2UnavailableNone listed
4.11.17affectedcustom4.11.17.3UnavailableNone listed
4.11.18affectedcustom4.11.18.1UnavailableNone listed
4.11.24unaffectedcustomUnavailable*None listed

org.apache.ws.commons.axiom.wso2:axiom

Vendor
WSO2
Product
org.apache.ws.commons.axiom.wso2:axiom
Platforms
Unknown
Default status
unknown
Package
org.apache.ws.commons.axiom.wso2:axiom
org.apache.ws.commons.axiom.wso2:axiom · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.2.11affectedcustom1.2.11.wso2v17_5UnavailableNone listed
1.2.11-wso2v21unaffectedcustomUnavailable*None listed

org.wso2.carbon:org.wso2.carbon.base

Vendor
WSO2
Product
org.wso2.carbon:org.wso2.carbon.base
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon:org.wso2.carbon.base
org.wso2.carbon:org.wso2.carbon.base · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.3affectedcustom4.5.3.46UnavailableNone listed
4.6.0affectedcustom4.6.0.2005UnavailableNone listed
4.6.1affectedcustom4.6.1.153UnavailableNone listed
4.6.2affectedcustom4.6.2.668UnavailableNone listed
4.6.3affectedcustom4.6.3.37UnavailableNone listed
4.6.4affectedcustom4.6.4.15UnavailableNone listed
4.7.1affectedcustom4.7.1.72UnavailableNone listed
4.8.1affectedcustom4.8.1.40UnavailableNone listed
4.9.0affectedcustom4.9.0.103UnavailableNone listed
4.9.26affectedcustom4.9.26.26UnavailableNone listed
4.9.27affectedcustom4.9.27.11UnavailableNone listed
4.9.28affectedcustom4.9.28.12UnavailableNone listed
4.10.9affectedcustom4.10.9.71UnavailableNone listed
4.10.42affectedcustom4.10.42.14UnavailableNone listed
4.9.30unaffectedcustomUnavailable4.9.*None listed
4.10.95unaffectedcustomUnavailable*None listed

org.wso2.carbon:org.wso2.carbon.utils

Vendor
WSO2
Product
org.wso2.carbon:org.wso2.carbon.utils
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon:org.wso2.carbon.utils
org.wso2.carbon:org.wso2.carbon.utils · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.3affectedcustom4.5.3.46UnavailableNone listed
4.6.0affectedcustom4.6.0.2005UnavailableNone listed
4.6.1affectedcustom4.6.1.153UnavailableNone listed
4.6.2affectedcustom4.6.2.668UnavailableNone listed
4.6.3affectedcustom4.6.3.37UnavailableNone listed
4.6.4affectedcustom4.6.4.15UnavailableNone listed
4.7.1affectedcustom4.7.1.72UnavailableNone listed
4.8.1affectedcustom4.8.1.40UnavailableNone listed
4.9.0affectedcustom4.9.0.103UnavailableNone listed
4.9.26affectedcustom4.9.26.26UnavailableNone listed
4.9.27affectedcustom4.9.27.11UnavailableNone listed
4.9.28affectedcustom4.9.28.12UnavailableNone listed
4.10.9affectedcustom4.10.9.71UnavailableNone listed
4.10.42affectedcustom4.10.42.14UnavailableNone listed
4.9.30unaffectedcustomUnavailable4.9.*None listed
4.10.95unaffectedcustomUnavailable*None listed