CVE-2025-10907

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

Affected Products (22)

wso2 · api_control_planevulnerable

wso2 · api_managervulnerable

wso2 · enterprise_integratorvulnerable

wso2 · identity_servervulnerable

wso2 · identity_server_as_key_managervulnerable

wso2 · open_banking_amvulnerable

wso2 · open_banking_iamvulnerable

wso2 · traffic_managervulnerable

wso2 · universal_gatewayvulnerable

References (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/

Vendor Advisory