{"id":"CVE-2025-13590","title":"Authenticated arbitrary file upload via a System REST API requiring administrator permission.","summary":"A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. \n\n By leveraging the vulnerabi…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"WSO2","product":"WSO2 API Manager","affected":["api_manager >= 4.2.0 < 4.2.0.179","api_manager >= 4.3.0 < 4.3.0.91","api_manager >= 4.4.0 < 4.4.0.55","api_manager >= 4.5.0 < 4.5.0.38","api_manager >= 4.6.0 < 4.6.0.3","api_control_plane >= 4.5.0 < 4.5.0.39","api_control_plane >= 4.6.0 < 4.6.0.3","universal_gateway >= 4.5.0 < 4.5.0.37","universal_gateway >= 4.6.0 < 4.6.0.3","traffic_manager >= 4.5.0 < 4.5.0.37","traffic_manager >= 4.6.0 < 4.6.0.3","org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.28.116 < 9.28.116.391","org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.29.120 < 9.29.120.210","org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.30.67 < 9.30.67.133","org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.31.86 < 9.31.86.100","org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.32.147 < 9.32.147.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-02-20T20:32:33.048480Z"},"published":"2026-02-19","updated":"2026-09-23","sourceUpdated":"2026-09-23T15:27:31.923Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-13590","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/"}],"tags":["cve.org"],"epss":0.00703,"epssPercentile":0.51875,"ingestedAt":"2026-09-23T16:27:22.665Z","slug":"CVE-2025-13590","body":"## Overview\n\nA malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. \n\n By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.\n\n## Affected\n\n- `api_manager >= 4.2.0 < 4.2.0.179`\n- `api_manager >= 4.3.0 < 4.3.0.91`\n- `api_manager >= 4.4.0 < 4.4.0.55`\n- `api_manager >= 4.5.0 < 4.5.0.38`\n- `api_manager >= 4.6.0 < 4.6.0.3`\n- `api_control_plane >= 4.5.0 < 4.5.0.39`\n- `api_control_plane >= 4.6.0 < 4.6.0.3`\n- `universal_gateway >= 4.5.0 < 4.5.0.37`\n- `universal_gateway >= 4.6.0 < 4.6.0.3`\n- `traffic_manager >= 4.5.0 < 4.5.0.37`\n- `traffic_manager >= 4.6.0 < 4.6.0.3`\n- `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.28.116 < 9.28.116.391`\n- `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.29.120 < 9.29.120.210`\n- `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.30.67 < 9.30.67.133`\n- `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.31.86 < 9.31.86.100`\n- `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl >= 9.32.147 < 9.32.147.2`\n\n## Remediation\n\nFollow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/#solution","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}