CVE-2025-13590: WSO2 API Manager arbitrary file upload in system REST API

Executive brief

WSO2 carbon-apimgt is an API management platform used to build and manage APIs. An authenticated administrator can upload arbitrary files through the administrative REST API, potentially achieving remote code execution on the deployment. This vulnerability could allow a compromised admin account or insider threat to take complete control of the API management infrastructure.

Technical details

The vulnerability is an unrestricted file upload issue (CWE-434) in the admin REST API of carbon-apimgt. An administrator with sufficient privileges can upload specially crafted payloads to arbitrary locations within the deployment without proper file type validation or location restrictions. The attack vector is network-based, requires high privileges (admin role), and does not require user interaction. Successful exploitation results in remote code execution with the privileges of the application server, potentially compromising all API management functions, stored credentials, and connected systems. The fix is available in version 9.32.167 and later.

Affected products

• WSO2 carbon-apimgt < 9.32.167

Timeline

• 2026-02-19: disclosed: Published to GitHub Advisory Database
• 2026-02-19: patched: Version 9.32.167 released with fix

References

• https://api.github.com/users/sealbenb
• https://github.com/sealbenb
• https://api.github.com/users/sealbenb/gists%7B/gist_id%7D
• https://api.github.com/users/sealbenb/repos
• https://avatars.githubusercontent.com/u/127010643?v=4
• https://api.github.com/users/sealbenb/events%7B/privacy%7D