CVE-2025-6623: WSO2 Carbon console stored cross-site scripting in XML input

CVE-2025-6623 · Severity: medium · CVSS 4.3 · Published 2026-10-19

WSO2's Carbon console, used for managing API gateways and traffic control, accepts XML input without properly encoding potentially executable content. An authenticated attacker with administrative privileges can inject malicious scripts that execute in victims' browsers when they view affected pages, potentially redirecting users or altering the web interface. Session hijacking is prevented by httpOnly session cookies.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager, Wso2 Universal Gateway. Vendors: Wso2.

Quick answers

Is CVE-2025-6623 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-6623 being exploited in the wild.
How severe is CVE-2025-6623?
Medium severity, with a CVSS score of 4.3, published 19 October 2026.
Which products and versions are affected?
Wso2 API Control Plane 4.5.0; Wso2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0; Wso2 Traffic Manager 4.5.0; Wso2 Universal Gateway 4.5.0.
Is there a fix for CVE-2025-6623?
Yes: fixed in WSO2 API Control Plane 4.5.0 Update 12; WSO2 API Manager 4.5.0 Update 11, 4.4.0 Update 29, 4.3.0 Update 66, 4.2.0 Update 153, 4.1.0 Update 215, 3.2.1 Update 53, 3.2.0 Update 433; WSO2 Traffic Manager 4.5.0 Update 11; WSO2 Universal Gateway 4.5.0 Update 11. Until then: Apply the fix from https://github.com/wso2/carbon-analytics-common/pull/870 or upgrade to the relevant update level for your product. Restrict administrative console access to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-6623 attacked?
It is attacked from the adjacent network, in a web application.
Am I affected by CVE-2025-6623?
Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: WSO2 API Control Plane 4.5.0 Update 12; WSO2 API Manager 4.5.0 Update 11, 4.4.0 Update 29, 4.3.0 Update 66, 4.2.0 Update 153, 4.1.0 Update 215, 3.2.1 Update 53, 3.2.0 Update 433; WSO2 Traffic Manager 4.5.0 Update 11; WSO2 Universal Gateway 4.5.0 Update 11

Apply the fix from https://github.com/wso2/carbon-analytics-common/pull/870 or upgrade to the relevant update level for your product. Restrict administrative console access to trusted users only.

Technical details

Stored XSS vulnerability in Carbon console due to improper output encoding of user-supplied XML input. An authenticated administrative user can inject malicious JavaScript payloads through XML fields; when other users view the affected page, the payload executes in their browser context. The vulnerability requires administrative privileges and user interaction, but enables persistent injection attacks across multiple visitors.

Affected products

  • WSO2 API Control Plane 4.5.0
  • WSO2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0
  • WSO2 Traffic Manager 4.5.0
  • WSO2 Universal Gateway 4.5.0

Timeline

  • 2026-01-26: disclosed: WSO2 security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.