{"id":"CVE-2025-13590","details":"A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. \n\n By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.","aliases":["GHSA-p6jf-79j3-33f3"],"modified":"2026-07-08T08:11:57.447074288Z","published":"2026-02-19T10:16:11.003Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*","cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.5.0-NA"},{"last_affected":"4.5.0-NA"},{"introduced":"4.6.0-NA"},{"last_affected":"4.6.0-NA"}],"source":"CPE_STRING","vendor_product":"wso2:api_control_plane"},{"cpes":["cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*","cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.5.0"},{"last_affected":"4.5.0"},{"introduced":"4.6.0"},{"last_affected":"4.6.0"}],"source":"CPE_STRING","vendor_product":"wso2:traffic_manager"},{"vendor_product":"wso2:universal_gateway","cpes":["cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*","cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.5.0"},{"last_affected":"4.5.0"},{"introduced":"4.6.0"},{"last_affected":"4.6.0"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wso2/product-apim","events":[{"introduced":"572610e8e6564a647044bdb454eda658e1253352"},{"last_affected":"8cc6ee54401aa3e3281cd7aeded278c9b7ed6988"}],"database_specific":{"extracted_events":[{"introduced":"4.2.0-NA"},{"last_affected":"4.2.0-NA"},{"introduced":"4.3.0-NA"},{"last_affected":"4.3.0-NA"},{"introduced":"4.4.0-NA"},{"last_affected":"4.4.0-NA"},{"introduced":"4.5.0-NA"},{"last_affected":"4.5.0-NA"},{"introduced":"4.6.0-NA"},{"last_affected":"4.6.0-NA"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*","cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*","cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*","cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*","cpe:2.3:a:wso2:api_manager:4.6.0:-:*:*:*:*:*:*"]}}],"versions":["4.2.0-NA","4.3.0-NA","4.4.0-NA","4.5.0-NA","4.6.0-NA","v4.6.0-tm-rc4","v4.6.0-tm","v4.6.0-rc4","v4.6.0","v4.6.0-gw-rc3","v4.6.0-tm-rc3","v4.6.0-acp-rc3","v4.6.0-rc3","v4.6.0-gw-rc2","v4.6.0-tm-rc2","v4.6.0-acp-rc2","v4.6.0-rc2","v4.6.0-gw-rc","v4.6.0-tm-rc","v4.6.0-acp-rc","v4.6.0-rc","v4.6.0-gw-beta","v4.6.0-tm-beta","v4.6.0-acp-beta","v4.6.0-beta","v4.6.0-gw-alpha3","v4.6.0-tm-alpha3","v4.6.0-acp-alpha3","v4.6.0-alpha3","v4.6.0-gw-alpha2","v4.6.0-tm-alpha2","v4.6.0-acp-alpha2","v4.6.0-alpha2","v4.6.0-alpha","v4.6.0-gw-alpha","v4.6.0-tm-alpha","v4.6.0-acp-alpha","v4.6.0-m1","v4.6.0-tm-m1","v4.6.0-gw-m1","v4.6.0-acp-m1","v4.5.0-rc2","v4.5.0","v4.5.0-gw-rc2","v4.5.0-gw","v4.5.0-tm-rc2","v4.5.0-tm","v4.5.0-acp-rc2","v4.5.0-acp","v4.5.0-rc","v4.5.0-gw-rc","v4.5.0-tm-rc","v4.5.0-acp-rc","v4.5.0-beta","v4.5.0-gw-beta","v4.5.0-tm-beta","v4.5.0-acp-beta","v4.5.0-acp-alpha","v4.5.0-tm-alpha","v4.5.0-gw-alpha","v4.5.0-m2","v4.5.0-acp-m1","v4.5.0-tm-m1","v4.5.0-gw-m1","v4.5.0-m1","v4.3.0-rc2","v4.3.0","v4.4.0-rc2","v4.4.0","v4.4.0-rc","v4.4.0-beta","v4.4.0-alpha","v4.4.0-m1","v4.3.0-rc","v4.3.0-beta","v4.3.0-alpha2","v4.3.0-alpha","v4.3.0-m2","v4.2.0-rc2","v4.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13590.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}