CVE-2026-3418Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
Updated under an hour ago ()
Does this affect you?
It affects WSO2 API Manager and 6 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
- CVSS
- 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-434
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- WSO2
- NVD analysis
- Deferred
- Record last updated
- Sep 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
WSO2 WSO2 API Manager wso2:api_manager (from the name) | from 4.4.0 before 4.4.0.67; from 4.5.0 before 4.5.0.52; from 4.6.0 before 4.6.0.16 | CNA record |
WSO2 WSO2 Traffic Manager wso2:traffic_manager (from the name) | from 4.5.0 before 4.5.0.51; from 4.6.0 before 4.6.0.16 | CNA record |
WSO2 WSO2 API Control Plane wso2:api_control_plane (from the name) | from 4.5.0 before 4.5.0.53; from 4.6.0 before 4.6.0.17 | CNA record |
WSO2 WSO2 Universal Gateway wso2:universal_gateway (from the name) | from 4.5.0 before 4.5.0.52; from 4.6.0 before 4.6.0.16 | CNA record |
WSO2 WSO2 Carbon API Management Implementation wso2:carbon_api_management_implementation (from the name) | from 9.30.67 before 9.30.67.156; from 9.31.86 before 9.31.86.141; from 9.32.147 before 9.32.147.44; from 9.33.104 not affected | CNA record |
WSO2 WSO2 API Manager Publisher REST API V4 wso2:api_manager_publisher_rest_api_v4 (from the name) | from 9.30.67 before 9.30.67.156; from 9.31.86 before 9.31.86.141; from 9.32.147 before 9.32.147.44; from 9.33.104 not affected | CNA record |
WSO2 WSO2 Carbon API Management API wso2:carbon_api_management_api (from the name) | from 9.30.67 before 9.30.67.156; from 9.33.104 not affected | CNA record |
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.