All vulnerabilities
CVE-2026-5430

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 Multiple Products
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationExploited in the wildAdded to KEV 24 Sep 2026CISA KEV
Exploit odds (EPSS)0.59%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.0.57Also 4.6.0.21, 4.5.0.56 and 12 moreCVE List
Federal deadline27 Sep 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV
Patching is not enoughCISA requires federal agencies to look for signs of compromise on affected systems, not only patch (forensic triage under BOD 26-04). Treat exposed systems as possibly compromised. CISA guidance

What fixes it

Show all 18 fixed versions
  • 4.1.0.257WSO2 API ManagerCVE List
  • 4.2.0.197WSO2 API ManagerCVE List
  • 4.3.0.108WSO2 API ManagerCVE List
  • 4.4.0.72WSO2 API ManagerCVE List
  • 4.5.0.57WSO2 API ManagerCVE List
  • 4.6.0.21WSO2 API ManagerCVE List
  • 9.20.74.401WSO2 Carbon API Manager Rest API UtilityCVE List
  • 9.28.116.417WSO2 Carbon API Manager Rest API UtilityCVE List
  • 9.29.120.236WSO2 Carbon API Manager Rest API UtilityCVE List
  • 9.30.67.167WSO2 Carbon API Manager Rest API UtilityCVE List
  • 9.31.86.158WSO2 Carbon API Manager Rest API UtilityCVE List
  • 9.32.147.59WSO2 Carbon API Manager Rest API UtilityCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 6 Aug 2026, 07:33 UTCPublishedCVE List
  2. 24 Sep 2026Added to CISA KEVCISA KEV

Description

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.

Text from CVE List

Affected versions 20

  • WSO2 Universal Gatewayaffected: 4.5.0 before 4.5.0.57CVE List
  • WSO2 Universal Gatewayaffected: 4.6.0 before 4.6.0.21CVE List
  • WSO2 Traffic Manageraffected: 4.5.0 before 4.5.0.56CVE List
  • WSO2 Traffic Manageraffected: 4.6.0 before 4.6.0.21CVE List
  • WSO2 API Control Planeaffected: 4.5.0 before 4.5.0.58CVE List
  • WSO2 API Control Planeaffected: 4.6.0 before 4.6.0.22CVE List
  • WSO2 API Managerunknown: all versions before 4.1.0CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.257CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.197CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.108CVE List
  • WSO2 API Manageraffected: 4.4.0 before 4.4.0.72CVE List
  • WSO2 API Manageraffected: 4.5.0 before 4.5.0.57CVE List
  • WSO2 API Manageraffected: 4.6.0 before 4.6.0.21CVE List
  • WSO2 Carbon API Manager Rest API Utilityaffected: 9.20.74 before 9.20.74.401CVE List
  • WSO2 Carbon API Manager Rest API Utilityaffected: 9.28.116 before 9.28.116.417CVE List
  • WSO2 Carbon API Manager Rest API Utilityaffected: 9.29.120 before 9.29.120.236CVE List
  • WSO2 Carbon API Manager Rest API Utilityaffected: 9.30.67 before 9.30.67.167CVE List
  • WSO2 Carbon API Manager Rest API Utilityaffected: 9.31.86 before 9.31.86.158CVE List
  • WSO2 Carbon API Manager Rest API Utilityaffected: 9.32.147 before 9.32.147.59CVE List
  • WSO2 Carbon API Manager Rest API Utilityunaffected: 9.33.106CVE List

References 3