CVE-2025-10907: wso2 api_control_plane

CVSS: 8.4v3.1HighAnalyzed

Published 05-11-2025Last modified 05-11-2025

Vulnerability summary

CVE-2025-10907 is a high (CVSS 8.4) vulnerability in wso2 api_control_plane. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.5% of scored vulnerabilities.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.4/10

010

High · v3.1 (CVE.org)

EPSS score

0.60%

0%100%

Low · +0.04 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

05-11-2025
PublishedVulnerability first disclosed.
05-11-2025
Last modifiedVulnerability information updated.

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

CVSS metrics

2 scores · 2 sources · 1 version

v3.18.4

EPSS trend

Probability

0.60%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

+0.04 pp

From 0.56% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Affected systems

Wso227 products

api_control_plane4.5.0
api_manager3.1.0 | 3.2.0 | 3.2.1 | 4.0.0 | 4.1.0 | 4.2.0 | 4.3.0 | 4.4.0 | 4.5.0
enterprise_integrator6.6.0
identity_server5.10.0 | 5.11.0 | 6.0.0 | 6.1.0 | 7.0.0 | 7.1.0
identity_server_as_key_manager5.10.0

open_banking_am2.0.0
open_banking_iam2.0.0
org.apache.ws.commons.axiom.wso2:axiom≥ 1.2.11, < 1.2.11.wso2v17_5
org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt≥ 0.14.13, < 0.14.13.8 | ≥ 0.14.16, < 0.14.16.1
org.wso2.carbon:org.wso2.carbon.base≥ 4.5.3, < 4.5.3.46 | ≥ 4.6.0, < 4.6.0.2005 | ≥ 4.6.1, < 4.6.1.153 | ≥ 4.6.2, < 4.6.2.668 | ≥ 4.6.3, < 4.6.3.37 | ≥ 4.6.4, < 4.6.4.15 | ≥ 4.7.1, < 4.7.1.72 | ≥ 4.8.1, < 4.8.1.40 | ≥ 4.9.0, < 4.9.0.103 | ≥ 4.9.26, < 4.9.26.26 | ≥ 4.9.27, < 4.9.27.11 | ≥ 4.9.28, < 4.9.28.12 | ≥ 4.10.9, < 4.10.9.71 | ≥ 4.10.42, < 4.10.42.14
org.wso2.carbon:org.wso2.carbon.utils≥ 4.5.3, < 4.5.3.46 | ≥ 4.6.0, < 4.6.0.2005 | ≥ 4.6.1, < 4.6.1.153 | ≥ 4.6.2, < 4.6.2.668 | ≥ 4.6.3, < 4.6.3.37 | ≥ 4.6.4, < 4.6.4.15 | ≥ 4.7.1, < 4.7.1.72 | ≥ 4.8.1, < 4.8.1.40 | ≥ 4.9.0, < 4.9.0.103 | ≥ 4.9.26, < 4.9.26.26 | ≥ 4.9.27, < 4.9.27.11 | ≥ 4.9.28, < 4.9.28.12 | ≥ 4.10.9, < 4.10.9.71 | ≥ 4.10.42, < 4.10.42.14
org.wso2.carbon.deployment:org.wso2.carbon.module.mgt≥ 4.9.15, < 4.9.15.2 | ≥ 4.10.1, < 4.10.1.1 | ≥ 4.10.9, < 4.10.9.2 | ≥ 4.11.1, < 4.11.1.3 | ≥ 4.11.3, < 4.11.3.3 | ≥ 4.11.7, < 4.11.7.5 | ≥ 4.11.14, < 4.11.14.2 | ≥ 4.11.17, < 4.11.17.3 | ≥ 4.11.18, < 4.11.18.1
org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt≥ 4.10.1, < 4.10.1.1 | ≥ 4.10.9, < 4.10.9.2 | ≥ 4.11.1, < 4.11.1.3 | ≥ 4.11.3, < 4.11.3.3 | ≥ 4.11.7, < 4.11.7.5 | ≥ 4.11.14, < 4.11.14.2 | ≥ 4.11.17, < 4.11.17.3 | ≥ 4.11.18, < 4.11.18.1
org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core≥ 2.2.14, < 2.2.14.7 | ≥ 2.2.17, < 2.2.17.2 | ≥ 2.3.1, < 2.3.1.3
org.wso2.carbon.mediation:org.wso2.carbon.mediation.library≥ 4.7.30, < 4.7.30.47 | ≥ 4.7.61, < 4.7.61.62 | ≥ 4.7.99, < 4.7.99.304 | ≥ 4.7.131, < 4.7.131.22 | ≥ 4.7.175, < 4.7.175.30 | ≥ 4.7.188, < 4.7.188.12 | ≥ 4.7.204, < 4.7.204.13 | ≥ 4.7.221, < 4.7.221.7 | ≥ 4.7.245, < 4.7.245.7
traffic_manager4.5.0
universal_gateway4.5.0
wso2 api control plane≥ 4.5.0, < 4.5.0.29
wso2 api manager≥ 3.1.0, < 3.1.0.345 | ≥ 3.2.0, < 3.2.0.448 | ≥ 3.2.1, < 3.2.1.66 | ≥ 4.0.0, < 4.0.0.367 | ≥ 4.1.0, < 4.1.0.230 | ≥ 4.2.0, < 4.2.0.169 | ≥ 4.3.0, < 4.3.0.81 | ≥ 4.4.0, < 4.4.0.45 | ≥ 4.5.0, < 4.5.0.28
wso2 enterprise integrator≥ 6.6.0, < 6.6.0.224
wso2 identity server≥ 5.10.0, < 5.10.0.375 | ≥ 5.11.0, < 5.11.0.419 | ≥ 6.0.0, < 6.0.0.248 | ≥ 6.1.0, < 6.1.0.248 | ≥ 7.0.0, < 7.0.0.124 | ≥ 7.1.0, < 7.1.0.31
wso2 identity server as key manager≥ 5.10.0, < 5.10.0.365
wso2 micro integrator≥ 4.0.0, < 4.0.0.145 | ≥ 4.1.0, < 4.1.0.147 | ≥ 4.2.0, < 4.2.0.141
wso2 open banking am≥ 2.0.0, < 2.0.0.394
wso2 open banking iam≥ 2.0.0, < 2.0.0.414
wso2 traffic manager≥ 4.5.0, < 4.5.0.27
wso2 universal gateway≥ 4.5.0, < 4.5.0.27

Show all 27

1 vendor · 27 products

References

1 links

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/Vendor Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities