Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.

An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.

Üreticinin çözüm notu (İngilizce)

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• security.docs.wso2.com/…ements/security-advisories/2026/WSO2-2026-5692 Üretici bülteni

Kayıt geçmişi

1. 28 Eki 2026 22:21Yayımlandı

İlgili açıklar

• 10,0 CVE-2026-61567AVideo-Encoder: unauthenticated command execution through streamer login trust
• 7,2 CVE-2026-118755Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
• 7,0 CVE-2026-118692CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
• 7,8 CVE-2026-118615Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
• 6,8 CVE-2026-118607Alpine iLX-F511 diagapp Command Injection Vulnerability
• 8,8 CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration