An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.
By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.
References
| Link | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3992/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
06 Oct 2025, 13:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:* |
|
| First Time |
Wso2 identity Server As Key Manager
Wso2 open Banking Iam Wso2 Wso2 enterprise Integrator Wso2 identity Server |
|
| References | () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3992/ - Vendor Advisory |
26 Sep 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-26 09:15
Updated : 2025-10-06 13:43
NVD link : CVE-2025-1862
Mitre link : CVE-2025-1862
CVE.ORG link : CVE-2025-1862
JSON object : View
Products Affected
wso2
- enterprise_integrator
- identity_server_as_key_manager
- identity_server
- open_banking_iam
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type