The vulnerability exists in the SchemaValidator Mediator of WSO2 API Manager, where XML and schema validation processes allow external entity resolution when processing user-supplied XML content. This improper handling of special elements in XML DTDs (CWE-776) can be exploited by a highly privileged actor to read arbitrary files accessible to the server, initiate outbound requests to unintended internal or external destinations, and cause excessive resource consumption during XML parsing. The vulnerability affects multiple exact versions of WSO2 API Manager as listed, with a CVSS 3.1 score of 8.7 indicating high severity. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to disclosure of sensitive files on the server, potential network-based attacks via outbound requests, and denial of service due to resource exhaustion. The impact is limited to actors with high privileges, but the consequences include confidentiality loss and availability degradation of the affected product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SchemaValidator Mediator and limit privileges to trusted users only. Monitor for unusual outbound network activity and resource usage related to XML processing. Follow vendor updates closely for any forthcoming patches or official mitigations.