CVE-2025-12544
Stored Cross-Site Scripting in Multiple WSO2 Products
Description
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.
INFO
Published Date :
Nov. 2, 2026, 11:17 a.m.
Last Modified :
Nov. 4, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | ed10eef1-636d-4fbe-9993-6890dfa878f8 |
Solution
- Validate all uploaded SVG files rigorously.
- Sanitize SVG content before rendering.
- Restrict file upload types.
- Update relevant application components.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-12544.
| URL | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/ |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-12544 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-12544
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-12544 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-12544 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Nov. 04, 2026
Action Type Old Value New Value Added Translation Title: WSO2 API Manager, Description: El portal del Editor no aplica una validación adecuada en los archivos SVG cargados, permitiendo a los usuarios con el rol de Editor inyectar scripts maliciosos. Esta vulnerabilidad puede ser explotada al cargar un archivo SVG manipulado, que luego es almacenado y renderizado por la aplicación. Las consecuencias de seguridad incluyen la capacidad para un actor malicioso de redirigir el navegador de la víctima a un sitio web arbitrario, modificar la interfaz de usuario de la página web o recuperar información del navegador. Sin embargo, el impacto se mitiga ya que las cookies sensibles relacionadas con la sesión están protegidas con el flag httpOnly, lo que previene el secuestro de sesión. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Nov. 02, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-12544', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-11-02T17:00:46.138574Z'} -
New CVE Received by ed10eef1-636d-4fbe-9993-6890dfa878f8
Nov. 02, 2026
Action Type Old Value New Value Added Description The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking. Added CVSS V3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Added CWE CWE-79 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/12xxx/CVE-2025-12544.json">CVE-2025-12544</a> Added Reference https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/