CVE-2025-12544
Description
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.
How to fix
- WSO2 WSO2 API Manager3.2.0.449, 3.2.1.68, 4.0.0.368, 4.1.0.60, 4.2.0.7 or later
- WSO2 WSO2 Carbon API Manager Publisher REST API9.28.140 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.449, 3.2.1 ≤ v < 3.2.1.68, 4.0.0 ≤ v < 4.0.0.368, 4.1.0 ≤ v < 4.1.0.60, 4.2.0 ≤ v < 4.2.0.7 | 3.2.0.449, 3.2.1.68, 4.0.0.368, 4.1.0.60, 4.2.0.7 |
| WSO2 WSO2 Carbon API Manager Publisher REST API | v < 9.28.140 | 9.28.140 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.