WSO2 Carbon API Management API vulnerabilities

2 vulnerabilities

Known vulnerabilities in WSO2 Carbon API Management API, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.8CVE-2025-4760org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.api+10
EPSS score
0.19%
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.9.1CVE-2026-3418wso2wso2 api control plane+6
EPSS score
0.76%
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.