The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.

Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE-434

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/

[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"4.4.0","lessThan":"4.4.0.67","versionType":"custom","status":"affected"},{"version":"4.5.0","lessThan":"4.5.0.52","versionType":"custom","status":"affected"},{"version":"4.6.0","lessThan":"4.6.0.16","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Traffic Manager","defaultStatus":"unaffected","versions":[{"version":"4.5.0","lessThan":"4.5.0.51","versionType":"custom","status":"affected"},{"version":"4.6.0","lessThan":"4.6.0.16","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 API Control Plane","defaultStatus":"unaffected","versions":[{"version":"4.5.0","lessThan":"4.5.0.53","versionType":"custom","status":"affected"},{"version":"4.6.0","lessThan":"4.6.0.17","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Universal Gateway","defaultStatus":"unaffected","versions":[{"version":"4.5.0","lessThan":"4.5.0.52","versionType":"custom","status":"affected"},{"version":"4.6.0","lessThan":"4.6.0.16","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Carbon API Management Implementation","defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl","versions":[{"version":"9.30.67","lessThan":"9.30.67.156","versionType":"custom","status":"affected"},{"version":"9.31.86","lessThan":"9.31.86.141","versionType":"custom","status":"affected"},{"version":"9.32.147","lessThan":"9.32.147.44","versionType":"custom","status":"affected"},{"version":"9.33.104","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"}]},{"vendor":"WSO2","product":"WSO2 API Manager Publisher REST API V4","defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1.common","versions":[{"version":"9.30.67","lessThan":"9.30.67.156","versionType":"custom","status":"affected"},{"version":"9.31.86","lessThan":"9.31.86.141","versionType":"custom","status":"affected"},{"version":"9.32.147","lessThan":"9.32.147.44","versionType":"custom","status":"affected"},{"version":"9.33.104","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"}]},{"vendor":"WSO2","product":"WSO2 Carbon API Management API","defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api","versions":[{"version":"9.30.67","lessThan":"9.30.67.156","versionType":"custom","status":"affected"},{"version":"9.33.104","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"}]}]