A component in WSO2 API Manager accepts XML input on the publisher interface without disabling external entity resolution, enabling an attacker to craft XML that references external entities. When processed, the server resolves these entities, allowing the attacker to read any file accessible to the process and to make HTTP GET requests to local or remote resources. This leads to confidential data exposure and potential extraction of sensitive configuration files, thus violating the confidentiality of the system.

The vulnerability affects WSO2 API Manager. Specific product versions are not listed in the advisory; administrators should consult the vendor’s documentation to determine which releases are impacted and apply the recommended fix.

The CVSS score of 3.5 indicates a low severity, and no EPSS score is available, implying limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog, further suggesting a low exploitation likelihood. Based on the description, the attack vector is inferred to be an external network request to the publisher endpoint carrying a malicious XML payload. The potential impact is limited to file read capabilities rather than full code execution or denial of service.