An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in WSO2 API Manager components (carbon-apimgt) due to insufficient validation of user-supplied input during API document upload in the Publisher portal.
A user with publisher privileges can upload a crafted API document whose contents are later rendered in the UI for other users, leading to attacker-controlled script execution. Likely outcomes include redirection to malicious sites, unauthorized UI modifications, or exfiltration of data accessible to the browser; session hijacking is mitigated by the use of HttpOnly session cookies.
To remediate, update to version 9.31.117 or above.
{
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-23T17:38:55Z",
"nvd_published_at": "2025-09-23T15:15:31Z",
"severity": "MODERATE"
}