Live › vulnerability › CVE-2022-29464
Go to dashboardSeveral WSO2 products accept file uploads without restricting file type, letting an attacker upload a file that the server then executes. The result is remote code execution on the affected server, and CISA lists it as actively exploited and tied to ransomware.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WSO2 Multiple Products | vendor | – | – |
Unknown from the sources.
Apply the vendor updates per WSO2 advisory for CVE-2022-29464; the sources do not list affected or fixed versions.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2022-29464")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.