An authenticated user with the Publisher role can upload a crafted SVG file to the Publisher portal, which is stored and later rendered without proper validation. The default embedding of the SVG allows the attacker to inject JavaScript code that can redirect the victim’s browser, modify the page’s user interface, or capture information from the browser context. The impact is limited to client‑side execution because session cookies are marked httpOnly, preventing direct session hijacking.

The vulnerability affects WSO2 API Manager and the Carbon API Manager Publisher REST API. Specific affected versions were not provided in the available data, so the product vendor’s documentation should be consulted for precise version information.

The CVSS score is 4.8, indicating a moderate severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated user with Publisher privileges who uploads an SVG file; no special environmental conditions are required beyond the normal operation of the Publisher portal. The exploitation risk is moderate, but the potential to deface or redirect users remains significant.