CVE-2025-1862
26.09.2025, 09:15
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.Enginsight
| Vendor | Product | Version |
|---|---|---|
| wso2 | enterprise_integrator | 6.6.0 |
| wso2 | identity_server | 5.10.0 |
| wso2 | identity_server | 5.11.0 |
| wso2 | identity_server | 6.0.0 |
| wso2 | identity_server | 6.1.0 |
| wso2 | identity_server_as_key_manager | 5.10.0 |
| wso2 | open_banking_iam | 2.0.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration