Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
Published Aug 6, 2026
9.1
CRITICALCVSS 3.1
EPSS 0.76%
Description
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
Affected products
-
- Version 4.5.0StatusaffectedConstraints<4.5.0.53
- Version 4.6.0StatusaffectedConstraints<4.6.0.17
- Version
-
- Version 4.4.0StatusaffectedConstraints<4.4.0.67
- Version 4.5.0StatusaffectedConstraints<4.5.0.52
- Version 4.6.0StatusaffectedConstraints<4.6.0.16
- Version
-
- Version 9.30.67StatusaffectedConstraints<9.30.67.156
- Version 9.31.86StatusaffectedConstraints<9.31.86.141
- Version 9.32.147StatusaffectedConstraints<9.32.147.44
- Version 9.33.104StatusunaffectedConstraints<=*
- Version
-
- Version 9.30.67StatusaffectedConstraints<9.30.67.156
- Version 9.33.104StatusunaffectedConstraints<=*
- Version
-
- Version 9.30.67StatusaffectedConstraints<9.30.67.156
- Version 9.31.86StatusaffectedConstraints<9.31.86.141
- Version 9.32.147StatusaffectedConstraints<9.32.147.44
- Version 9.33.104StatusunaffectedConstraints<=*
- Version
-
- Version 4.5.0StatusaffectedConstraints<4.5.0.51
- Version 4.6.0StatusaffectedConstraints<4.6.0.16
- Version
-
- Version 4.5.0StatusaffectedConstraints<4.5.0.52
- Version 4.6.0StatusaffectedConstraints<4.6.0.16
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WSO2 | WSO2 API Control Plane | unaffected |
| |||||||||||||||
| WSO2 | WSO2 API Manager | unaffected |
| |||||||||||||||
| WSO2 | WSO2 API Manager Publisher REST API V4 | n/a |
| |||||||||||||||
| WSO2 | WSO2 Carbon API Management API | n/a |
| |||||||||||||||
| WSO2 | WSO2 Carbon API Management Implementation | n/a |
| |||||||||||||||
| WSO2 | WSO2 Traffic Manager | unaffected |
| |||||||||||||||
| WSO2 | WSO2 Universal Gateway | unaffected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/#solution
References (1)
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/ vendor-advisory
| Link | Providers | Tags |
|---|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/ | vendor-advisory |
Change history (0)
No recorded changes yet.