Arbitrary File Upload Vulnerability in WSO2 Products
CVE-2025-1862

6.7MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Enterprise Integrator
Wso2 Identity Server
Wso2 Open Banking Iam
Wso2 Identity Server As Key Manager
Vendor
CVE Published:
26 September 2025

What is CVE-2025-1862?

A vulnerability has been identified in multiple WSO2 products that stems from inadequate validation of user-supplied filenames within the BPEL uploader SOAP service endpoint. This flaw allows an attacker with administrative permissions to upload arbitrary files to a user-controlled directory on the server. By exploiting this vulnerability, a malicious user could upload a specially crafted payload, which may lead to remote code execution (RCE). If successfully executed, this could result in full system compromise and unauthorized access to sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WSO2 Enterprise Integrator 6.6.0 < 6.6.0.215

WSO2 Identity Server 5.10.0 < 5.10.0.347

WSO2 Identity Server 5.11.0 < 5.11.0.396

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Luk Luk
JSON
.