nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-1862 CVE-2025-1862
MEDIUM
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
Record summary
CVE-2025-1862 has a selected CVSS score of 6.7 (medium).
Description
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 27, 2025 · Source: CVE List
Affected products and versions
4| Product | Source | Version range | Status |
|---|---|---|---|
WSO2 Enterprise IntegratorBrowse WSO2 / WSO2 Enterprise IntegratorDefault status: unaffected | CVE List | 6.6.0 to < 6.6.0.215 | affected |
WSO2 Identity ServerBrowse WSO2 / WSO2 Identity ServerDefault status: unaffected | CVE List | Before 5.10.0 | unknown |
| 5.10.0 to < 5.10.0.347 | affected | ||
| 5.11.0 to < 5.11.0.396 | affected | ||
| 6.0.0 to < 6.0.0.232 | affected | ||
| 6.1.0 to < 6.1.0.224 | affected | ||
WSO2 Identity Server as Key ManagerBrowse WSO2 / WSO2 Identity Server as Key ManagerDefault status: unaffected | CVE List | Before 5.10.0 | unknown |
| 5.10.0 to < 5.10.0.340 | affected | ||
WSO2 Open Banking IAMBrowse WSO2 / WSO2 Open Banking IAMDefault status: unaffected | CVE List | 2.0.0 to < 2.0.0.391 | affected |
References
2security.docs.wso2.comVendor advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3992