WSO2 API Control Plane System REST API unrestricted upload

Summaryinfo

A vulnerability was found in WSO2 API Control Plane, API Manager, API Manager Publisher REST API V4, API Manager Traffic Manager, Carbon API Management API, Carbon API Management Implementation and Universal Gateway. It has been rated as problematic. The affected element is an unknown function of the component System REST API. Performing a manipulation results in unrestricted upload. This vulnerability is cataloged as CVE-2026-3418. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in WSO2 API Control Plane, API Manager, API Manager Publisher REST API V4, API Manager Traffic Manager, Carbon API Management API, Carbon API Management Implementation and Universal Gateway. It has been classified as problematic. This affects an unknown function of the component System REST API. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

It is possible to read the advisory at security.docs.wso2.com. This vulnerability is uniquely identified as CVE-2026-3418 since 03/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/07/2026). The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2085). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source WSO2 API Manager

Productinfo

Type

• Automation Software

Vendor

• WSO2

Name

• API Control Plane
• API Manager
• API Manager Publisher REST API V4
• API Manager Traffic Manager
• Carbon API Management API
• Carbon API Management Implementation
• Universal Gateway

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion