PT-2025-45145 · Wso2 · Wso2 Products

Crnković · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-10907

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description An arbitrary file upload issue exists due to inadequate validation of uploaded content and destination within SOAP admin services. An attacker with administrative privileges can upload a crafted file to a location they control within the deployment. Successful exploitation could result in remote code execution (RCE) on the server, depending on how the uploaded file is handled. This issue is exploitable only by users with administrative access to the affected SOAP services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-10907

Affected Products

Wso2 Products

References · 4

• https://osv.dev/vulnerability/CVE-2025-10907 · Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10907 · Security Note
• https://t.me/CVEtracker/36632 · Telegram Post