CVE-2025-10907

highpriority · track · 29EPSS 0.006 · 48 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.60% (48th) EPSS

CVSS 7.2 · high

Is it mine?

107 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.

cvss

Technical severity, 0–10. One row per scoring source.

8.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.4

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.2 · impact 5.9

v3.18.4highCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.4highCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 1.7 · impact 6

v3.16.6mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-434US

affected products (107)

Products and version ranges known to be affected.

WSO2 WSO2 API Control Plane4.5.0 → 4.5.0.29enisa_euvdEU
WSO2 WSO2 API Manager3.1.0 → 3.1.0.345enisa_euvdEU
WSO2 WSO2 API Manager3.2.0 → 3.2.0.448enisa_euvdEU
WSO2 WSO2 API Manager3.2.1 → 3.2.1.66enisa_euvdEU
WSO2 WSO2 API Manager4.0.0 → 4.0.0.367enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.230enisa_euvdEU
WSO2 WSO2 API Manager4.2.0 → 4.2.0.169enisa_euvdEU
WSO2 WSO2 API Manager4.3.0 → 4.3.0.81enisa_euvdEU
WSO2 WSO2 API Manager4.4.0 → 4.4.0.45enisa_euvdEU
WSO2 WSO2 API Manager4.5.0 → 4.5.0.28enisa_euvdEU
WSO2 WSO2 Enterprise Integrator6.6.0 → 6.6.0.224enisa_euvdEU
WSO2 WSO2 Identity Server5.10.0 → 5.10.0.375enisa_euvdEU
WSO2 WSO2 Identity Server5.11.0 → 5.11.0.419enisa_euvdEU
WSO2 WSO2 Identity Server6.0.0 → 6.0.0.248enisa_euvdEU
WSO2 WSO2 Identity Server6.1.0 → 6.1.0.248enisa_euvdEU
WSO2 WSO2 Identity Server7.0.0 → 7.0.0.124enisa_euvdEU
WSO2 WSO2 Identity Server7.1.0 → 7.1.0.31enisa_euvdEU
WSO2 WSO2 Identity Server as Key Manager5.10.0 → 5.10.0.365enisa_euvdEU
WSO2 WSO2 Micro Integrator4.0.0 → 4.0.0.145enisa_euvdEU
WSO2 WSO2 Micro Integrator4.1.0 → 4.1.0.147enisa_euvdEU

showing 20 of 107

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd NVD CVE.org MITRE

published 2025-11-05modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan