The vulnerability exists in the SchemaValidator Mediator of WSO2 API Manager, where XML and schema validation functionalities process XML input. Under certain conditions, the XML parser resolves external entities in user-supplied XML during validation flows. Exploitation requires high privileges and crafted XML payloads. Successful exploitation can lead to disclosure of server files, unintended outbound network requests, and denial of service through excessive resource consumption during XML parsing.

An attacker with high privileges can exploit this vulnerability to read sensitive files accessible to the server, potentially leaking confidential information. Additionally, the attacker may cause the server to make outbound requests to internal or external systems, which could be leveraged for further attacks or data exfiltration. The vulnerability can also cause excessive resource consumption during XML parsing, leading to denial of service and impacting the availability of the WSO2 API Manager service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor WSO2 advisories for updates. Until a fix is available, restrict access to highly privileged users who can supply XML to the SchemaValidator Mediator and consider disabling or limiting XML external entity processing if configurable.