Vulnerability Details CVE-2025-1862
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.
By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 50.3%
CVSS Severity
CVSS v3 Score 6.7
Products affected by CVE-2025-1862
-
cpe:2.3:a:wso2:enterprise_integrator:6.6.0
-
cpe:2.3:a:wso2:identity_server:5.10.0
-
cpe:2.3:a:wso2:identity_server:5.11.0
-
cpe:2.3:a:wso2:identity_server:6.0.0
-
cpe:2.3:a:wso2:identity_server:6.1.0
-
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0
-
cpe:2.3:a:wso2:open_banking_iam:2.0.0