CVE-2026-5430

WSO2 API products suffered a path traversal vulnerability allowing unrestricted file uploads and remote code execution.

The path traversal flaw in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway enabled attackers to upload arbitrary files and execute remote code. DIB organizations must ensure these products are patched immediately, as the vulnerability is actively exploited in the wild and could lead to full system compromise or data exfiltration.

Shame score — A path traversal vulnerability leading to remote code execution was actively exploited in the wild, indicating a severe and avoidable failure in patch management and security hygiene.