cveboard RSS feed

CVE-2025-3125

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.360UnavailableNone listed
5.11.0affectedcustom5.11.0.399UnavailableNone listed
6.0.0affectedcustom6.0.0.235UnavailableNone listed
6.1.0affectedcustom6.1.0.230UnavailableNone listed
7.0.0affectedcustom7.0.0.101UnavailableNone listed
7.1.0affectedcustom7.1.0.32UnavailableNone listed

WSO2 Enterprise Integrator

Vendor
WSO2
Product
WSO2 Enterprise Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Integrator · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom6.6.0UnavailableNone listed
6.6.0affectedcustom6.6.0.217UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.402UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.353UnavailableNone listed

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.2.0UnavailableNone listed
3.2.0affectedcustom3.2.0.421UnavailableNone listed
3.2.1affectedcustom3.2.1.41UnavailableNone listed
4.0.0affectedcustom4.0.0.342UnavailableNone listed
4.1.0affectedcustom4.1.0.203UnavailableNone listed
4.2.0affectedcustom4.2.0.142UnavailableNone listed
4.3.0affectedcustom4.3.0.55UnavailableNone listed
4.4.0affectedcustom4.4.0.19UnavailableNone listed
4.5.0affectedcustom4.5.0.2UnavailableNone listed
4.6.0affectedcustom4.6.0.3UnavailableNone listed

WSO2 API Control Plane

Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.2UnavailableNone listed
4.6.0affectedcustom4.6.0.3UnavailableNone listed

WSO2 Universal Gateway

Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.2UnavailableNone listed
4.6.0affectedcustom4.6.0.3UnavailableNone listed

WSO2 Traffic Manager

Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.2UnavailableNone listed
4.6.0affectedcustom4.6.0.3UnavailableNone listed

org.wso2.carbon.commons:org.wso2.carbon.application.upload

Vendor
WSO2
Product
org.wso2.carbon.commons:org.wso2.carbon.application.upload
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.commons:org.wso2.carbon.application.upload
org.wso2.carbon.commons:org.wso2.carbon.application.upload · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.7.19affectedcustom4.7.19.7UnavailableNone listed
4.7.32affectedcustom4.7.32.5UnavailableNone listed
4.7.35affectedcustom4.7.35.8UnavailableNone listed
4.7.39affectedcustom4.7.39.1UnavailableNone listed
4.7.49affectedcustom4.7.49.4UnavailableNone listed
4.7.52affectedcustom4.7.52.1UnavailableNone listed
4.10.13affectedcustom4.10.13.1UnavailableNone listed
4.9.12unaffectedcustomUnavailable4.9.*None listed
4.10.24unaffectedcustomUnavailable*None listed