Loading...
Skip to main content
GeekWala

CVE-2025-13590 — Vulnerability in...

CRITICAL

carbon-apimgt does not properly restrict uploaded files

Published February 19, 2026Updated August 14, 2026Source: osv

Summary

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Advisory Timeline

  • First published February 19, 2026 (235 days ago).
  • Last revised August 14, 2026 — 176 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 to 9.32.167 or later
<!-- Update pom.xml dependency version to 9.32.167 for org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1
maven
6.6.202, 6.6.203, 6.6.204, 6.6.205 (+1583 more)9.32.167

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-434
    Unrestricted File UploadMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-13590?
carbon-apimgt does not properly restrict uploaded files This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-13590?
CVE-2025-13590 affects org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-13590 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-p6jf-79j3-33f3

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies