CVE-2025-12544
Stored Cross-Site Scripting in Multiple WSO2 Products
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.
Fixes and workarounds
Fix
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/#solution
Source: CNA: WSO2Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| WSO2 API Manager WSO2 |
≥ 0; < 3.2.0 (unknown, custom) ≥ 3.2.0; < 3.2.0.449 (affected, custom) ≥ 3.2.1; < 3.2.1.68 (affected, custom) ≥ 4.0.0; < 4.0.0.368 (affected, custom) ≥ 4.1.0; < 4.1.0.60 (affected, custom) ≥ 4.2.0; < 4.2.0.7 (affected, custom) Other versions: unaffected |
CNA: WSO2 |
| WSO2 Carbon API Manager Publisher REST API WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1
|
≥ 0; < 9.28.140 (affected, custom)
Other versions: unaffected |
CNA: WSO2 |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 4.8 medium |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | CNA: WSO2 |
| 3.1 / 4.8 medium |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | NVD: ed10eef1-636d-4fbe-9993-6890dfa878f8 |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/CNA: WSO2 · vendor-advisory
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/ed10eef1-636d-4fbe-9993-6890dfa878f8