CRITICALCVSS 9.1EPSS 0.7%

CVE-2025-13590

carbon-apimgt does not properly restrict uploaded files

Published: 2026-02-19
Modified: 2026-08-14
EPSS percentile: 49%
Aliases: GHSA-p6jf-79j3-33f3
Sources: github-advisory

Summary

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1	—	9.32.167

Remediation: Upgrade to 9.32.167 or later.

References

https://github.com/advisories/GHSA-p6jf-79j3-33f3

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.