PT-2026-20797 · Api · Api

Thilan Dissanayaka · Published 2026-02-19 · Updated 2026-02-20 · CVE-2025-13590

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025-13590

Description A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution (RCE), enabling an attacker to execute arbitrary code on the affected system remotely. The vulnerability involves uploading a specially crafted payload via the ''/api/v1/upload'' endpoint. The file parameter is vulnerable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-13590

GHSA-P6JF-79J3-33F3

Affected Products

Api

References · 13

• https://osv.dev/vulnerability/GHSA-p6jf-79j3-33f3 · Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13590 · Security Note
• https://github.com/wso2/carbon-apimgt/pull/13560 · Note
• https://github.com/wso2/carbon-apimgt/releases/tag/v9.32.167 · Note
• https://github.com/wso2/carbon-apimgt · Note
• https://github.com/wso2/carbon-apimgt/commit/49a6427b39a5d9552ce97430858bb4b1912a3044 · Note
• https://twitter.com/CveTodo/status/2024508850968154151 · Twitter Post
• https://twitter.com/CCBalert/status/2024901593821249592 · Twitter Post
• https://twitter.com/TheHackerWire/status/2024515138720838043 · Twitter Post
• https://twitter.com/CVEnew/status/2024501226906456117 · Twitter Post
• https://t.me/CVEtracker/45110 · Telegram Post