# CVE-2025-13590: WSO2 API Manager arbitrary file upload in system REST API

Source: https://junglewise.ai/threats/cve-2025-13590-wso2-api-manager-arbitrary-file-upload-in-system-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-19. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2025-13590 · Severity: critical · CVSS 9.1 · Published 2026-02-19

WSO2 carbon-apimgt is an API management platform used to build and manage APIs. An authenticated administrator can upload arbitrary files through the administrative REST API, potentially achieving remote code execution on the deployment. This vulnerability could allow a compromised admin account or insider threat to take complete control of the API management infrastructure.

Technologies: [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane), [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager), [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager), [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2025-13590 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13590 being exploited in the wild.

**How severe is CVE-2025-13590?** Critical severity, with a CVSS score of 9.1, published 19 February 2026.

**Which products and versions are affected?** org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven) < 9.32.167, ECOSYSTEM:introduced=0,fixed=9.32.167; Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0; Wso2 Carbon-Apimgt < 9.32.167; and 2 more.

**Is there a fix for CVE-2025-13590?** Yes. org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven): upgrade to 9.32.167 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13590 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-13590?** Check whether you run org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven), Wso2 API Control Plane, Wso2 API Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven): upgrade to 9.32.167 or later

  ```sh
  # set org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 to 9.32.167 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is an unrestricted file upload issue (CWE-434) in the admin REST API of carbon-apimgt. An administrator with sufficient privileges can upload specially crafted payloads to arbitrary locations within the deployment without proper file type validation or location restrictions. The attack vector is network-based, requires high privileges (admin role), and does not require user interaction. Successful exploitation results in remote code execution with the privileges of the application server, potentially compromising all API management functions, stored credentials, and connected systems. The fix is available in version 9.32.167 and later.

## Affected products

- WSO2 carbon-apimgt < 9.32.167

## Identifiers

- CVE-2025-13590
- GHSA-p6jf-79j3-33f3

## Timeline

- 2026-02-19: disclosed: Published to GitHub Advisory Database
- 2026-02-19: patched: Version 9.32.167 released with fix

## References

- [https://api.github.com/users/sealbenb](https://api.github.com/users/sealbenb)
- [https://github.com/sealbenb](https://github.com/sealbenb)
- [https://api.github.com/users/sealbenb/gists%7B/gist_id%7D](https://api.github.com/users/sealbenb/gists%7B/gist_id%7D)
- [https://api.github.com/users/sealbenb/repos](https://api.github.com/users/sealbenb/repos)
- [https://avatars.githubusercontent.com/u/127010643?v=4](https://avatars.githubusercontent.com/u/127010643?v=4)
- [https://api.github.com/users/sealbenb/events%7B/privacy%7D](https://api.github.com/users/sealbenb/events%7B/privacy%7D)

## Related threats

- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)
- [WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with)
- [WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control)