A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.
By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
References
| Link | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Feb 2026, 21:19
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-434 |
19 Feb 2026, 19:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wso2 api Manager
Wso2 Wso2 traffic Manager Wso2 universal Gateway Wso2 api Control Plane |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/ - Vendor Advisory | |
| CPE | cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.6.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:* |
19 Feb 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-19 10:16
Updated : 2026-02-20 21:19
NVD link : CVE-2025-13590
Mitre link : CVE-2025-13590
CVE.ORG link : CVE-2025-13590
JSON object : View
Products Affected
wso2
- api_control_plane
- api_manager
- universal_gateway
- traffic_manager
CWE