Multiple SOAP admin services in WSO2 products allow authenticated users to upload files with insufficient validation on the filename or extension. By using path traversal in the filename, an attacker can write arbitrary files to the server, including JSP web shells into web-accessible directories.
The vulnerability exists independently in multiple services, including EventSimulatorAdminService, LibraryUploader, ModuleAdminService, WebappAdmin, and JaggeryAppAdmin. The latter two provide an even more direct path, accepting .war archives that are automatically extracted into a web-accessible directory.
When combined with authentication bypass vulnerabilities (CVE-2025-9152, CVE-2025-10611), this enables full pre-auth remote code execution.
This vulnerability was responsibly disclosed and has been patched by the vendor.