CVE-2022-29464: WSO2 unrestricted file upload to unauthenticated RCE
The short version: Several WSO2 products have an unrestricted file-upload flaw (CVE-2022-29464) that lets an unauthenticated attacker upload a file into the web root and execute code — a classic web-shell-to-RCE. It's in CISA's KEV catalog, ransomware-associated, and has been mass-exploited. If you run an affected WSO2 product, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-16 |
| Known exploited? | Yes — KEV-listed, ransomware-associated, mass-exploited |
| Vulnerability type | CWE-22 / unrestricted file upload → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Multiple WSO2 products, including API Manager 2.2.0–4.0.0, Identity Server 5.2.0–5.11.0, Identity Server Analytics 5.4.0/5.4.1/5.5.0/5.6.0, Identity Server as Key Manager 5.3.0–5.11.0, Enterprise Integrator 6.2.0–6.6.0, and Open Banking AM/KM 1.4.0–2.0.0 |
| Fixed in | The patched releases per WSO2's advisory (WSO2-2021-1738) |
What you need to know
CVE-2022-29464 is an unrestricted file upload across multiple WSO2 products. By posting to a /fileupload endpoint with a Content-Disposition directory-traversal sequence, an unauthenticated attacker writes a file to a directory under the web root — such as the deployment webapps directory — and then executes it, typically dropping a web shell for full remote code execution.
Why this belongs at the top of the queue:
- It's pre-authentication and trivially reachable. No credential, no chain — a single crafted upload.
- The target is identity infrastructure. Many affected products are identity and API-management servers; code execution there reaches authentication for everything behind them.
- It's mass-exploited. KEV-listed, ransomware-associated, with an EPSS at the ceiling — exposed, unpatched instances are hunted continuously.
How serious we see it
High — the 9.8 is earned here.
Unauthenticated remote code execution on internet-facing identity and integration servers, KEV-listed and ransomware-associated with maximum EPSS, is as top-of-queue as it gets. We rate it by what it does. The bounded, reassuring part is that it's specific and fixed: defined product/version ranges, published patches, and quick-to-confirm exposure. The catch is the usual one for a widely exploited flaw — patched and clean are separate questions, so hunt as well as patch.
Recommendations
Straight from WSO2's advisory and CISA:
- Patch now. Apply the WSO2 fix (advisory WSO2-2021-1738) for your product and version.
- Assume nothing given the exploitation history — hunt. Look for web shells and unexpected files under the deployment/web directories.
- If compromised, respond fully. Rebuild where warranted and rotate all credentials, keys, and certificates the server could reach — this is identity infrastructure.
- Restrict exposure. Keep management consoles and the
/fileuploadsurface off the open internet where possible. - Confirm your exposure first. Verify which WSO2 products and versions you run.
How BreachRisk sees it
BreachRisk discovers internet-facing WSO2 consoles from the outside, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited CVE so it rises to the top of your results. Safe verification isn't offered for this one — confirming it would require uploading a file — so BreachRisk detects and prioritizes the exposure rather than exploiting it. The value is that an exposed, affected WSO2 is already on your map when the flaw matters.