CVE-2025-13647
Received Received - Intake

Content-Type Header Validation Bypass in Certificate File Path Disclosure

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: WSO2 LLC

Description
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2025-13647

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper validation of the content-type header in requests. An attacker can craft a request with a manipulated content-type header to expose file paths of certificate files, leading to information disclosure.

Detection Guidance

To detect this vulnerability, monitor HTTP requests for improper content-type header handling in WSO2 Identity Server or Open Banking IAM. Check logs for requests with manipulated content-type headers that may expose certificate file paths. Use tools like curl to test endpoints for header validation issues.

Impact Analysis

Exploitation could allow attackers to learn sensitive file paths, potentially enabling further attacks or compromising system confidentiality by disclosing certificate file locations.

Compliance Impact

This vulnerability could lead to information disclosure by exposing certificate file paths, which may violate confidentiality requirements under GDPR and HIPAA. Unauthorized access to file paths could result in data breaches, triggering compliance violations for data protection and security controls.

Mitigation Strategies

Apply the public fixes provided by WSO2 for the affected versions of Identity Server or Open Banking IAM. Update to the specified patched versions if available. For community users, apply relevant fixes; for support subscribers, update to the specified or higher update levels as outlined in the WSO2 security advisory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...