CVE-2025-10713: 
Java vulnerability analysis and mitigation

An XML External Entity (XXE) vulnerability (CVE-2025-10713) exists in multiple WSO2 products due to improper configuration of the XML parser. The vulnerability was discovered and disclosed in November 2025, affecting various WSO2 products. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities (NVD).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). It has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H. The vulnerability stems from the application's failure to properly restrict XML external entity references when parsing user-supplied XML content (NVD).

A successful exploitation of this vulnerability could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable. The vulnerability primarily impacts system confidentiality and availability (NVD).