CVE-2025-10713: Medium XXE in Multiple WSO2 Products

CVE-2025-10713 is a medium severity (CVSS 6.5) XML external entity flaw in several WSO2 products, including API Manager and Identity Server. WSO2 says community users should apply the public fix or move to a newer release, and subscribers should update to the listed U2 level or higher.

What's affected

WSO2 advisory WSO2-2025-4505 lists these affected versions:

• API Control Plane 4.5.0
• API Manager 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0 and 3.1.0
• Enterprise Integrator 6.6.0
• Identity Server 7.1.0, 5.11.0 and 5.10.0
• Identity Server as Key Manager 5.10.0
• Open Banking AM 2.0.0 and Open Banking IAM 2.0.0
• Traffic Manager 4.5.0 and Universal Gateway 4.5.0

The advisory gives no fixed version numbers for community releases. For customers with a support subscription it lists a minimum U2 update level for each product:

How to check if you're exposed

1. Identify every WSO2 product in your estate and its version. Each product reports its version in the management console and in the install directory name.
2. Compare each against the list above. Include gateways and traffic managers, since they appear in the advisory.
3. If you have a subscription, check the current update level on the host with the WSO2 Updates tool and compare it with the table.
4. Community users should check whether the public change in the carbon-mediation repository (pull request 1784, named by the advisory) is present in the build they run.
5. Note which services accept XML from outside the trusted network, since that decides how urgent the work is.

A dependency inventory helps here, because these products often sit inside images and shared platforms that nobody lists. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory where you can look up the CVE record alongside related weaknesses.

What to do now

1. Build a list of affected WSO2 products and owners.
2. Subscribers: update to the U2 level in the table or higher.
3. Community users: apply the public fix named in the advisory, or migrate to the latest unaffected version of the product. The advisory does not name specific fixed community versions, so confirm with WSO2.
4. Restrict network access to the affected services while you work, especially paths that accept XML.
5. Review logs for unexpected file read errors or service outages that could match entity resolution or denial of service.
6. Confirm the attack prerequisites with WSO2. The advisory text describes a remote, unauthenticated attacker, but the CVSS vector in the record lists high privileges required (PR:H) and the advisory does not explain the difference.
7. Record the update level you reach and the date.

Why it matters

XML external entity flaws happen when a parser is allowed to resolve references that the document itself defines. The parser may then read local files or fetch remote content for the sender. This is the class CWE-611. The usual defence is to disable external entity and document type features in the parser.

WSO2 says a successful attack could read sensitive files from the server or make services unavailable. The record does not show this CVE on CISA's Known Exploited Vulnerabilities list. For identity and API gateway products, file read can expose configuration and keys, so the medium score should not push the work down the list.

Quick check

Sources

• Gold record for CVE-2025-10713
• WSO2 advisory WSO2-2025-4505

Last reviewed: 19 October 2026.