CVE-2025-13590

critical · 9.1

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

9.1

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2026-02-19

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
wso2	api_control_plane	4.5.0
wso2	api_control_plane	4.6.0
wso2	api_manager	4.2.0
wso2	api_manager	4.3.0
wso2	api_manager	4.4.0
wso2	api_manager	4.5.0
wso2	api_manager	4.6.0
wso2	traffic_manager	4.5.0
wso2	traffic_manager	4.6.0
wso2	universal_gateway	4.5.0
wso2	universal_gateway	4.6.0

Check a specific version with /api/v1/cve/match.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-13590