CVE-2025-13590
Awaiting Analysis Awaiting Analysis - Queue
Arbitrary File Upload in REST API Enables Remote Code Execution

Publication date: 2026-02-19

Last updated on: 2026-02-20

Assigner: WSO2 LLC

Description
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-19
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-02-19
EPSS Evaluated
2026-06-15
NVD
CVE-2025-13590
EUVD
EUVD-2025-207682
Affected Vendors & Products
Showing 11 associated CPEs
Vendor Product Version / Range
wso2 api_manager 4.2.0
wso2 api_manager 4.3.0
wso2 api_manager 4.4.0
wso2 api_manager 4.5.0
wso2 api_control_plane 4.5.0
wso2 traffic_manager 4.5.0
wso2 universal_gateway 4.5.0
wso2 api_control_plane 4.6.0
wso2 api_manager 4.6.0
wso2 traffic_manager 4.6.0
wso2 universal_gateway 4.6.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

I don't know

Detection Guidance

I don't know

Executive Summary

This vulnerability allows a malicious actor who already has administrative privileges to upload an arbitrary file to a location controlled by the user within the deployment through a system REST API.

If the upload is successful, it may lead to remote code execution by leveraging a specially crafted payload.

Impact Analysis

The vulnerability can have severe impacts including remote code execution, which means an attacker could run malicious code on the affected system.

This can lead to full compromise of the system, including unauthorized access, data theft, data manipulation, or disruption of services.

Compliance Impact

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13590. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart