CVE-2026-5430
WSO2 Multiple Products Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-09-24. Federal due date: 2026-09-27.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Impact
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wso2 | Api Control Plane | from 4.5.0 before 4.5.0.58 from 4.6.0 before 4.6.0.22 |
| Wso2 | Api Manager | from 4.1.0 before 4.1.0.257 from 4.2.0 before 4.2.0.197 from 4.3.0 before 4.3.0.108 from 4.4.0 before 4.4.0.72 from 4.5.0 before 4.5.0.57 from 4.6.0 before 4.6.0.21 |
| Wso2 | Traffic Manager | from 4.5.0 before 4.5.0.56 from 4.6.0 before 4.6.0.21 |
| Wso2 | Universal Gateway | from 4.5.0 before 4.5.0.57 from 4.6.0 before 4.6.0.21 |