CVE-2025-10907
Published: 05 November 2025
Summary
CVE-2025-10907 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wso2 Api Manager. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 38.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the core issue of insufficient validation of uploaded content and destination in SOAP admin services by enforcing input validation mechanisms.
Remediates the specific arbitrary file upload flaw by identifying, prioritizing, and applying vendor patches or updates from the WSO2 security advisory.
Reduces exploitability by ensuring only essential personnel have the high administrative privileges required to access the vulnerable SOAP services.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in authenticated SOAP admin services enables exploitation of remote services for RCE (T1210) and facilitates web shell deployment (T1505.003).
NVD Description
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within…
more
the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.
Deeper analysisAI
CVE-2025-10907 is an arbitrary file upload vulnerability affecting multiple WSO2 products, caused by insufficient validation of uploaded content and destination in SOAP admin services. Published on 2025-11-05, it allows a malicious actor with administrative privileges to upload a specially crafted file to a user-controlled location within the deployment. The issue is classified under CWE-434 and carries a CVSS v3.1 base score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Exploitation requires administrative access to the affected SOAP services. An attacker with such privileges can upload a malicious file, which may lead to remote code execution (RCE) on the server, depending on how the file is subsequently processed. The adjacent network access vector (AV:A) and high privileges requirement (PR:H) limit the blast radius, but successful scope change (S:C) enables high-impact confidentiality, integrity, and availability violations.
Mitigation guidance is available in the WSO2 security advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/.
Details
- CWE(s)