Threat Intelligence Database

CVE-2026-3418 is a critical vulnerability in WSO2 API Manager that allows authenticated users with publisher privileges to upload files without proper validation. This can lead to files being written to arbitrary server-accessible locations, potentially enabling remote code execution depending on the environment and file handling. The vulnerability affects versions 4.4.0, 4.5.0, and 4.6.0 of WSO2 API Manager.

CVE-2025-6508 is a medium severity cross-site scripting (XSS) vulnerability in the Swagger UI Try-out console of WSO2 API Manager. It allows loading an external Swagger API definition URL, which can override existing API definitions in the API Publisher portal. This can mislead users into interacting with maliciously altered API definitions, potentially exposing sensitive information or causing unintended backend requests.

CVE-2025-8154 is a medium severity vulnerability in WSO2 API Manager versions 4.1.0 through 4.5.0. It involves improper neutralization of special elements in HTTP request headers during Webhook API invocations, allowing injection of arbitrary HTTP response headers. This can enable manipulation of browser caching, alteration of security headers, and potential exposure of sensitive information such as cookies, which may facilitate session hijacking. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.