---
title: "CVE-2025-13590: carbon-apimgt does not properly restrict uploaded files"
url: https://erroneo.us/security/cve/CVE-2025-13590/
description: "CVE-2025-13590 (org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven)): A malicious actor with administrative privileges can upload an…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-02-19
date_modified: 2026-09-23
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-13590"
kev: false
cvss: 9.1
epss: 0.00768
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-13590: carbon-apimgt does not properly restrict uploaded files

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.8% , percentile 55: FIRST’s model estimates a 0.8% chance of exploitation activity in the next 30 days, higher than 55% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (Maven) < 9.32.167, fixed in 9.32.167 . Check your lockfile, including transitive dependencies.

## What it is

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

## Affected packages

- Maven `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1` < 9.32.167 → fixed: 9.32.167

## Affected products (CVE record)

- WSO2 WSO2 API Manager: 4.2.0 < 4.2.0.179, 4.3.0 < 4.3.0.91, 4.4.0 < 4.4.0.55, 4.5.0 < 4.5.0.38, 4.6.0 < 4.6.0.3
- WSO2 WSO2 API Control Plane: 4.5.0 < 4.5.0.39, 4.6.0 < 4.6.0.3
- WSO2 WSO2 Universal Gateway: 4.5.0 < 4.5.0.37, 4.6.0 < 4.6.0.3
- WSO2 WSO2 Traffic Manager: 4.5.0 < 4.5.0.37, 4.6.0 < 4.6.0.3
- WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl: 9.28.116 < 9.28.116.391, 9.29.120 < 9.29.120.210, 9.30.67 < 9.30.67.133, 9.31.86 < 9.31.86.100, 9.32.147 < 9.32.147.2

## Severity

- WSO2 CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.77% probability of exploitation activity in the next 30 days; percentile 55.

## Sources

- [security.docs.wso2.com](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/)
- [GitHub Advisory GHSA-p6jf-79j3-33f3](https://github.com/advisories/GHSA-p6jf-79j3-33f3)
- [CVE.org record CVE-2025-13590](https://www.cve.org/CVERecord?id=CVE-2025-13590)
- [NVD entry CVE-2025-13590](https://nvd.nist.gov/vuln/detail/CVE-2025-13590)
- [github.com](https://github.com/wso2/carbon-apimgt/pull/13560)
- [github.com](https://github.com/wso2/carbon-apimgt/commit/49a6427b39a5d9552ce97430858bb4b1912a3044)
- [github.com](https://github.com/wso2/carbon-apimgt/releases/tag/v9.32.167)

---
Source page: https://erroneo.us/security/cve/CVE-2025-13590/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt