CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

HIGH

8.7

CVSS Score

Published: August 6, 2026 at 05:32 PM UTC

Updated: October 28, 2026 at 08:08 AM UTC

6 products affected across 1 vendorAPI ManagerAPI Control PlaneTraffic Manager

Using WSO2 API Manager by WSO2?

Get instant alerts when new vulnerabilities affect WSO2 API Manager - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.7

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

API Control Plane · WSO2

90%

4.5.0 4.6.0

Affected range stops below 4.5.0.54, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.0.17, so it looks safe — our inference, not a vendor statement

API Manager · WSO2

90%

3.2.0 3.2.1 4.1.0 4.2.0 4.3.0 4.4.0 4.5.0 4.6.0

Affected range stops below 3.2.0.472, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.2.1.91, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.1.0.254, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.2.0.194, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.0.105, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.0.68, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5.0.53, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.0.16, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 3.2.0 (unknown)

Carbon API Gateway · WSO2

90%

6.7.206 6.7.210 9.20.74 9.28.116 9.29.120 9.30.67 9.31.86 9.32.147

Affected range stops below 6.7.206.594, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.7.210.95, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.20.74.398, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.28.116.412, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.29.120.228, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.30.67.158, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.31.86.147, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.32.147.38, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 9.33.61 (unaffected)

Carbon Apimgt Impl · WSO2maven