CVE-2025-13590

Critical · 9.1

CVSS

9.1

EPSS

0.8%

Published

Feb 19, 2026

CISA due date

—

The record

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.

Affected packages

Ecosystem	Package	Introduced	Fixed
Maven	org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl	0	9.32.167

Related vulnerabilities

GHSA-p6jf-79j3-33f3 carbon-apimgt does not properly restrict uploaded files Same vulnerability