The System REST API in WSO2 API Manager versions 4.4.0, 4.5.0, and 4.6.0 accepts file uploads from authenticated users with publisher privileges without enforcing sufficient validation on file types or upload destinations. This lack of validation allows these users to write files to arbitrary locations accessible by the server. Depending on deployment specifics and how uploaded files are processed, this vulnerability could lead to execution of malicious content, resulting in remote code execution. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An authenticated user with publisher privileges can upload files to arbitrary locations on the server, potentially leading to remote code execution. This can compromise the confidentiality, integrity, and availability of the affected system. The severity is critical due to the possibility of full system compromise if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict publisher privileges to trusted users only and monitor for suspicious file uploads. Review deployment configurations to limit the impact of arbitrary file writes.