CVE-2025-2905

An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.<br /> <br /> <br /> This vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks.<br /> <br /> <br /> <br /> * <br /> On systems running JDK 7 or early JDK 8, full file contents may be exposed.<br /> <br /> <br /> <br /> <br /> * <br /> On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.<br /> <br /> <br /> <br /> <br /> * <br /> DoS attacks such as "Billion Laughs" payloads can cause service disruption.