Vulnerability Summary
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.
Technical Analysis
- CVE ID: CVE-2025-3125
- Published: 2025-11-05T15:15:33.953
- Status: Active
How to Fix & Protect
The primary mitigation is to update the affected software immediately. Check the vendor's official security advisory for the latest patch.
Mitigation: If a patch is not available, restrict network access to the vulnerable component or disable the service.