CVE-2025-3125: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An…

PriorityP351high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

0.76%

50.6th percentile

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.

Affected

50 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	enterprise_integrator	—	—
wso2	identity_server	—	—
wso2	identity_server	—	—
wso2	identity_server	—	—
wso2	identity_server	—	—
wso2	identity_server	—	—
wso2	identity_server_as_key_manager	—	—
wso2	open_banking_iam	—	—
wso2	org.wso2.carbon.commons_org.wso2.carbon.application.upload	>= 4.10.13 < 4.10.13.1	4.10.13.1
wso2	org.wso2.carbon.commons_org.wso2.carbon.application.upload	>= 4.7.19 < 4.7.19.7	4.7.19.7
wso2	org.wso2.carbon.commons_org.wso2.carbon.application.upload	>= 4.7.32 < 4.7.32.5	4.7.32.5
wso2	org.wso2.carbon.commons_org.wso2.carbon.application.upload	>= 4.7.35 < 4.7.35.8	4.7.35.8
wso2	org.wso2.carbon.commons_org.wso2.carbon.application.upload	>= 4.7.39 < 4.7.39.1	4.7.39.1
wso2	org.wso2.carbon.commons_org.wso2.carbon.application.upload	>= 4.7.49 < 4.7.49.4	4.7.49.4
wso2	org.wso2.carbon.commons_org.wso2.carbon.application.upload	>= 4.7.52 < 4.7.52.1	4.7.52.1
wso2	traffic_manager	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.