A vulnerability, which was classified as critical, has been found in WSO2 Identity Server, Enterprise Integrator, Open Banking IAM, Identity Server as Key Manager, API Manager, API Control Plane, Universal Gateway, Traffic Manager and org.wso2.carbon.commons:org.wso2.carbon.application.upload. This issue affects the function
CarbonAppUploader of the component Admin Service Endpoint. Performing manipulation results in unrestricted upload.
This vulnerability is cataloged as CVE-2025-3125. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
