ACTIVELY EXPLOITED
CVE-2022-29464: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
| Vendor | WSO2 |
|---|---|
| Product | Multiple Products |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Apr 2022 |
| CISA federal deadline | 16 May 2022 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
SOURCES
Other WSO2 flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.