CVE-2026-5430 · High · CISA KEV

WSO2 Path Traversal: Unrestricted File Upload Leads to RCE, Exploited in Wild

Threat Engine Auto-Feed · data current as of 2026-09-25

A path traversal vulnerability in multiple WSO2 products allows for unrestricted file upload, potentially leading to remote code execution. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog. Organizations using affected WSO2 products should prioritize mitigation.

  • CVSS:
  • EPSS percentile: 0.45384
  • Exploitation pressure: 52/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 45th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves a 'path traversal' flaw, where an attacker can manipulate file paths to access directories and files outside of the intended scope. In this case, it specifically enables 'unrestricted file upload,' meaning an attacker can place arbitrary files, including malicious ones, anywhere on the system they can reach through path manipulation.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using WSO2 API Control Plane, API Manager, Traffic Manager, or Universal Gateway
  • Financial services organizations (due to assessed targeting by FIN7, LockBit affiliates, APT38)
  • Technology sector organizations (due to assessed targeting by APT29, Scattered Spider)

Misconfigurations that escalate it

  • Lack of robust input validation on file upload functionalities
  • Insufficient access controls on file system directories

High-impact scenarios

  • Remote Code Execution (RCE) on affected WSO2 systems, leading to full system compromise
  • Data exfiltration or modification due to arbitrary file access
  • Establishment of persistent access by uploading backdoors or malicious scripts

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor WSO2 product logs for unusual file upload activity or attempts to access restricted directories.
  • Implement file integrity monitoring (FIM) on WSO2 server directories to detect unauthorized file changes or additions.
  • Scan WSO2 deployments for known indicators of compromise (IOCs) related to path traversal or RCE exploits.

Contain

  • Isolate affected WSO2 instances from the network if compromise is suspected.
  • Review and restrict network access to WSO2 management interfaces and API endpoints.
  • Implement web application firewalls (WAFs) with rules to detect and block path traversal attempts.

Patch

  • Apply vendor-provided security patches for WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway immediately.

Frontier verdict — High

This vulnerability requires urgent attention due to its active exploitation in the wild and potential for remote code execution.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.