{"id":"CVE-2025-2905","aliases":["GHSA-h94w-8qhg-3xmc"],"url":"https://o3.security/vulnerability/CVE-2025-2905","summary":"WSO2 API Manager XML External Entity (XXE) vulnerability","details":"An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.\n\nThis vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks.\n\n  *  On systems running JDK 7 or early JDK 8, full file contents may be exposed.\n\n  *  On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.\n\n  *  DoS attacks such as \"Billion Laughs\" payloads can cause service disruption.","published":"2025-05-05T09:15:15.923Z","modified":"2026-10-24T10:30:31.026222316Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.wso2.am:am-distribution-parent","fixedVersion":"2.1.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2905"},{"type":"PACKAGE","url":"https://github.com/wso2/product-apim"},{"type":"WEB","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:31.026222316Z"}}