CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

View on CVE.org

Published Aug 6, 2026 CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Description

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.

Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 3.2.0
`3.2.0`	affected	< 3.2.0.472
`3.2.1`	affected	< 3.2.1.91
`4.1.0`	affected	< 4.1.0.254
`4.2.0`	affected	< 4.2.0.194
`4.3.0`	affected	< 4.3.0.105
`4.4.0`	affected	< 4.4.0.68
`4.5.0`	affected	< 4.5.0.53
`4.6.0`	affected	< 4.6.0.16

WSO2

WSO2 Universal Gateway

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.53
`4.6.0`	affected	< 4.6.0.16

WSO2

WSO2 Traffic Manager

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.52
`4.6.0`	affected	< 4.6.0.16

WSO2

WSO2 API Control Plane

unaffected

Version	Status	Constraints
`4.5.0`	affected	< 4.5.0.54
`4.6.0`	affected	< 4.6.0.17

WSO2

WSO2 Carbon API Gateway

unknown

Version	Status	Constraints
`6.7.206`	affected	< 6.7.206.594
`6.7.210`	affected	< 6.7.210.95
`9.20.74`	affected	< 9.20.74.398
`9.28.116`	affected	< 9.28.116.412
`9.29.120`	affected	< 9.29.120.228
`9.30.67`	affected	< 9.30.67.158
`9.31.86`	affected	< 9.31.86.147
`9.32.147`	affected	< 9.32.147.38
`9.33.61`	unaffected	≤ *

WSO2

WSO2 Carbon API Management Implementation

unknown

Version	Status	Constraints
`6.7.206`	affected	< 6.7.206.594
`6.7.210`	affected	< 6.7.210.95
`9.20.74`	affected	< 9.20.74.398
`9.28.116`	affected	< 9.28.116.412
`9.29.120`	affected	< 9.29.120.228
`9.30.67`	affected	< 9.30.67.158
`9.31.86`	affected	< 9.31.86.147
`9.32.147`	affected	< 9.32.147.38
`9.33.61`	unaffected	≤ *

No data.

Vendor Product Versions

Wso2

Wso2 Api Control Plane

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.54)`	affected	generic	—
`[4.6.0,4.6.0.17)`	affected	generic	—

Wso2

Wso2 Api Manager

Version	Status	Scheme	Platform
`[3.2.0,3.2.0.472)`	affected	generic	—
`[3.2.1,3.2.1.91)`	affected	generic	—
`[4.1.0,4.1.0.254)`	affected	generic	—
`[4.2.0,4.2.0.194)`	affected	generic	—
`[4.3.0,4.3.0.105)`	affected	generic	—
`[4.4.0,4.4.0.68)`	affected	generic	—
`[4.5.0,4.5.0.53)`	affected	generic	—
`[4.6.0,4.6.0.16)`	affected	generic	—

Wso2

Wso2 Carbon Api Gateway

Version	Status	Scheme	Platform
`[6.7.206,6.7.206.594)`	affected	generic	—
`[6.7.210,6.7.210.95)`	affected	generic	—
`[9.20.74,9.20.74.398)`	affected	generic	—
`[9.28.116,9.28.116.412)`	affected	generic	—
`[9.29.120,9.29.120.228)`	affected	generic	—
`[9.30.67,9.30.67.158)`	affected	generic	—
`[9.31.86,9.31.86.147)`	affected	generic	—
`[9.32.147,9.32.147.38)`	affected	generic	—
`[9.33.61,*)`	unaffected	generic	—

Wso2

Wso2 Carbon Api Management Implementation

Version	Status	Scheme	Platform
`[6.7.206,6.7.206.594)`	affected	generic	—
`[6.7.210,6.7.210.95)`	affected	generic	—
`[9.20.74,9.20.74.398)`	affected	generic	—
`[9.28.116,9.28.116.412)`	affected	generic	—
`[9.29.120,9.29.120.228)`	affected	generic	—
`[9.30.67,9.30.67.158)`	affected	generic	—
`[9.31.86,9.31.86.147)`	affected	generic	—
`[9.32.147,9.32.147.38)`	affected	generic	—
`[9.33.61,*)`	unaffected	generic	—

Wso2

Wso2 Traffic Manager

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.53)`	affected	generic	—
`[4.6.0,4.6.0.16)`	affected	generic	—

Wso2

Wso2 Universal Gateway

Version	Status	Scheme	Platform
`[4.5.0,4.5.0.53)`	affected	generic	—
`[4.6.0,4.6.0.16)`	affected	generic	—

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.486% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/

History

Aug 7, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 6, 2026 10:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
Title		XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
First Time appeared		Wso2 Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Carbon Api Gateway Wso2 wso2 Carbon Api Management Implementation Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway
Weaknesses		CWE-776
CPEs		cpe:2.3:a:wso2:wso2_api_control_plane:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_carbon_api_gateway:::::::: cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:::::::: cpe:2.3:a:wso2:wso2_traffic_manager:::::::: cpe:2.3:a:wso2:wso2_universal_gateway::::::::
Vendors & Products		Wso2 Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Carbon Api Gateway Wso2 wso2 Carbon Api Management Implementation Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/
Metrics		cvssV3_1 `{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H'}`

Subscriptions

Wso2 Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Gateway Wso2 Carbon Api Management Implementation Wso2 Traffic Manager Wso2 Universal Gateway

Weaknesses