Actively exploited in the wild

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

WSO2 - Multiple Products · Listed in the CISA KEV since 2022-04-25. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2022-29464

CriticalCVSS 9.8KEV

Published: 18/04/2022(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as ../../../../repository/deployment/server/webapps. Affects WSO2 API Manager 2.2.0-4.0.0, WSO2 Identity Server 5.2.0-5.11.0, WSO2 Identity Server Analytics 5.4.0-5.6.0, WSO2 Identity Server as Key Manager 5.3.0-5.11.0, WSO2 Enterprise Integrator 6.2.0-6.6.0, WSO2 Open Banking AM 1.4.0-2.0.0, and WSO2 Open Banking KM 1.4.0-2.0.0.

Risk Assessment

An attacker can upload a malicious file and execute arbitrary code on the WSO2 server, potentially leading to full system compromise and data breach.

Recommendation

Update WSO2 products to patched versions and restrict access to file upload endpoints.

Other vulnerabilities in WSO2 products

CVE-2026-1728Critical
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. A low-privileged user can invoke Admin REST APIs of WSO2 products.

Original NVD description (English source)

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.