CVE-2026-3418
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
At a glance
- Severity
- CRITICAL 9.1
- EPSS
- EPSS 0.76 % · percentile 55 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
- NVD status
- Deferred
Description
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | WSO2 |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2026-54209
- GCVE · GCVE-0-2026-3418
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 API Manager | affected 4.4.0 < 4.4.0.67 ; affected 4.5.0 < 4.5.0.52 ; affected 4.6.0 < 4.6.0.16 |
| WSO2 · WSO2 Traffic Manager | affected 4.5.0 < 4.5.0.51 ; affected 4.6.0 < 4.6.0.16 |
| WSO2 · WSO2 API Control Plane | affected 4.5.0 < 4.5.0.53 ; affected 4.6.0 < 4.6.0.17 |
| WSO2 · WSO2 Universal Gateway | affected 4.5.0 < 4.5.0.52 ; affected 4.6.0 < 4.6.0.16 |
| WSO2 · WSO2 Carbon API Management Implementation | affected 9.30.67 < 9.30.67.156 ; affected 9.31.86 < 9.31.86.141 ; affected 9.32.147 < 9.32.147.44 ; unaffected 9.33.104 ≤ * |
| WSO2 · WSO2 API Manager Publisher REST API V4 | affected 9.30.67 < 9.30.67.156 ; affected 9.31.86 < 9.31.86.141 ; affected 9.32.147 < 9.32.147.44 ; unaffected 9.33.104 ≤ * |
| WSO2 · WSO2 Carbon API Management API | affected 9.30.67 < 9.30.67.156 ; unaffected 9.33.104 ≤ * |
References
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |