CVE-2025-13590 Authenticated arbitrary file upload via a System REST API requiring administrator permission.

What is CVE-2025-13590?

CVE-2025-13590 is a critical vulnerability in Wso2 Api Manager, published on 19 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.

By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Weakness: CWE-434

Which versions are affected by CVE-2025-13590?

2 open source packages ship an affected version, including org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1. It affects 4 products.

Products include Wso2 Api Control Plane, Wso2 Api Manager, Wso2 Traffic Manager, Wso2 Universal Gateway.

How do I fix CVE-2025-13590?

Upgrade org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 to 9.32.167 or later.

Is CVE-2025-13590 being exploited?

There is no known exploitation of CVE-2025-13590 in the wild and no public exploit code.

Other vulnerabilities in Wso2 Api Manager

• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability Exploited Critical 10.0
• CVE-2026-1728 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover Critical 9.8
• CVE-2025-9312 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products Critical 9.8
• CVE-2025-10611 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs Critical 9.8
• CVE-2025-9152 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint Critical 9.8

All Wso2 Api Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p6jf-79j3-33f3.