Actively exploited in the wild
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
WSO2 - Multiple Products · Listed in the CISA KEV since 2022-04-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-29464
CriticalCVSS 9.8KEVSummary
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as ../../../../repository/deployment/server/webapps. Affects WSO2 API Manager 2.2.0-4.0.0, WSO2 Identity Server 5.2.0-5.11.0, WSO2 Identity Server Analytics 5.4.0-5.6.0, WSO2 Identity Server as Key Manager 5.3.0-5.11.0, WSO2 Enterprise Integrator 6.2.0-6.6.0, WSO2 Open Banking AM 1.4.0-2.0.0, and WSO2 Open Banking KM 1.4.0-2.0.0.
Risk Assessment
An attacker can upload a malicious file and execute arbitrary code on the WSO2 server, potentially leading to full system compromise and data breach.
Recommendation
Update WSO2 products to patched versions and restrict access to file upload endpoints.
Other vulnerabilities in WSO2 products
See all- CVE-2026-1728Critical
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. A low-privileged user can invoke Admin REST APIs of WSO2 products.
- CVE-2025-9804Critical
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.
- CVE-2025-14260High
WSO2 Products have an improper implementation of access control rules, allowing malicious actors to perform a Server Side Request Forgery (SSRF) attack. Exploitation allows access to both internal and external resources available through the network or filesystem.
- CVE-2025-0663Medium
A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key used across all tenants to sign authentication cookies allows a privileged user in one tenant to forge authentication cookies for users in other tenants.
- CVE-2025-5717Medium
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to SOAP admin services can deploy a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.
Original NVD description (English source)
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS