Live › vulnerability › CVE-2025-14260
Go to dashboardSome WSO2 products accept user-supplied resource locations without enforcing validation, so an unauthenticated attacker can make the server send requests to arbitrary internal or external addresses. An attacker can use this to reach internal services and filesystem resources the product can access, potentially exposing sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:35 UTC. All times on this page are UTC.
Teams running a WSO2 product that accepts resource location input on an exposed endpoint are potentially affected. The sources do not say which WSO2 products or configurations are vulnerable, so the exact exposure is unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.
Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
This page as .md · .json · in your agent: get_signal("CVE-2025-14260")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.