CVE-2025-3125: wso2 api_control_plane

Vulnerability summary

CVE-2025-3125 is a high (CVSS 7.2) vulnerability in wso2 api_control_plane. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities.

Timeline

1. 05-11-2025
   PublishedVulnerability first disclosed.
2. 20-01-2026
   Last modifiedVulnerability information updated.

Description

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.