High
Security advisory
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-12737
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:13 UTC · Revision 1
Source evidence
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
osv:CVE-2025-12737
Complete source record
{
"id": "ea894d22ba0bc00bf9d76dc11355a67ab71876042599f53a188d16ae5c8a5ce1",
"url": "https://osv.dev/vulnerability/CVE-2025-12737",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-12737",
"summary": "The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.",
"evidence": "osv:CVE-2025-12737",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-12737",
"aliases": [
"CVE-2025-12737"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wso2/product-apim",
"type": "GIT",
"events": [
{
"introduced": "4705aad25fb5621e1d2369eddfe538750ff1cc9c"
},
{
"last_affected": "4705aad25fb5621e1d2369eddfe538750ff1cc9c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wso2:api_manager:4.6.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.6.0"
},
{
"last_affected": "4.6.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.6.0",
"v4.6.0-rc4",
"v4.6.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12737.json"
}
}
],
"modified": "2026-10-27T02:45:10.354980152Z",
"provider": "osv",
"references": [
"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:api_control_plane",
"extracted_events": [
{
"range": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.5.0.36"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:api_manager",
"extracted_events": [
{
"range": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.0.349"
},
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.0.453"
},
{
"introduced": "3.2.1"
},
{
"fixed": "3.2.1.73"
},
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.0.373"
},
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.0.236"
},
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.0.176"
},
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.0.88"
},
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.0.52"
},
{
"introduced": "4.5.0"
},
{
"fixed": "4.5.0.35"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:identity_server",
"extracted_events": [
{
"range": [
{
"introduced": "5.10.0"
},
{
"fixed": "5.10.0.378"
},
{
"introduced": "5.11.0"
},
{
"fixed": "5.11.0.425"
},
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.0.252"
},
{
"introduced": "6.1.0"
},
{
"fixed": "6.1.0.253"
},
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.0.130"
},
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.0.38"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:identity_server_as_key_manager",
"extracted_events": [
{
"range": [
{
"introduced": "5.10.0"
},
{
"fixed": "5.10.0.369"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:open_banking_am",
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.0.398"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:open_banking_iam",
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.0.418"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:traffic_manager",
"extracted_events": [
{
"range": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.5.0.34"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:universal_gateway",
"extracted_events": [
{
"range": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.5.0.34"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:api_control_plane:4.6.0:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:api_control_plane",
"extracted_events": [
{
"range": [
{
"introduced": "4.6.0"
},
{
"last_affected": "4.6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:identity_server",
"extracted_events": [
{
"range": [
{
"introduced": "7.2.0"
},
{
"last_affected": "7.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:traffic_manager",
"extracted_events": [
{
"range": [
{
"introduced": "4.6.0"
},
{
"last_affected": "4.6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:universal_gateway",
"extracted_events": [
{
"range": [
{
"introduced": "4.6.0"
},
{
"last_affected": "4.6.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2025-12737",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 460095,
"published_at": "2026-09-03T14:17:00.183+00:00"
}