CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
Authenticated publishers can upload arbitrary files via the System REST API, potentially leading to remote code execution on WSO2 API Management products.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3418?
CVE-2026-3418 is a critical vulnerability in WSO2 API Control Plane, published on 6 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
Weakness: CWE-434
Which versions are affected by CVE-2026-3418?
How do I fix CVE-2026-3418?
No fix has been published for CVE-2026-3418 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3418 being exploited?
There is no known exploitation of CVE-2026-3418 in the wild and no public exploit code.
Sources
Also known as GHSA-xx79-g5wr-vq89.