What is CVE-2025-1862?

CVE-2025-1862 is a medium-severity vulnerability in Wso2 Enterprise Integrator, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 6.7/10. Published 2025-09-26.

How severe is CVE-2025-1862?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Arbitrary file upload in Wso2 Enterprise Integrator

CVE-2025-1862

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary…

Vulnerability class: Unrestricted File Upload

EPSS: 0.005 (64.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L.

Affected products

Wso2 Enterprise Integrator — versions 6.6.0
Wso2 Identity Server — versions 0, 5.10.0, 5.11.0
Wso2 Identity Server As Key Manager — versions 0, 5.10.0
Wso2 Open Banking Iam — versions 2.0.0

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/202… (vendor-advisory)

Frequently asked questions

What is CVE-2025-1862?: CVE-2025-1862 is a medium-severity vulnerability in Wso2 Enterprise Integrator, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 6.7/10. Published 2025-09-26.
How severe is CVE-2025-1862?: Medium severity. CVSS v3 base score is 6.7 out of 10.