CVE-2025-1862CWE-434unrestricted-file-upload

CVE-2025-1862

Medium · published September 26, 2025

CVSS v3.1
6.7
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.

By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-09-26T13:15Z
Affected products (7)
ProductVersionsFixed in
wso2/enterprise_integratorall versions—
wso2/identity_serverall versions—
wso2/identity_serverall versions—
wso2/identity_serverall versions—
wso2/identity_serverall versions—
wso2/identity_server_as_key_managerall versions—
wso2/open_banking_iamall versions—
References (1)
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3992/ · ed10eef1-636d-4fbe-9993-6890dfa878f8
EPSS history
Timeline
  • 26 SEP 08:18Z
    Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
    cvelistv5