EXPLOIT/ALERT Back to feed

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.

Published 12 Oct 2026Updated 12 Oct 2026740 sources
CVSS 10.0 PoC CANDIDATE△ CISA KEV
Overview Sources History

What happened

Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.

Affected versions

Multiple Products: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
SploitusArbitrary file upload to RCE in WSO2 via JSP shell upload to target server.KitPloit2026-10-10T00:31:29CandidatePoC-in-GitHub · hakivvi/CVE-2022-29464WSO2 RCE (CVE-2022-29464) exploit and writeup.★ 377hakivvi2022-04-20CandidatePoC-in-GitHub · tufanturhan/wso2-rce-cve-2022-29464★ 2tufanturhan2022-04-21CandidatePoC-in-GitHub · mr-r3bot/WSO2-CVE-2022-29464Pre-auth RCE bug CVE-2022-29464★ 2mr-r3bot2022-04-21CandidatePoC-in-GitHub · Lidong-io/cve-2022-29464cve-2022-29464 批量脚本★ 5Lidong-io2022-04-22CandidatePoC-in-GitHub · hev0x/CVE-2022-29464WSO2 RCE (CVE-2022-29464)★ 5hev0x2022-04-22CandidatePoC-in-GitHub · gpiechnik2/nmap-CVE-2022-29464Repository containing nse script for vulnerability CVE-2022-29464 known as WSO2 RCE.★ 3gpiechnik22022-04-22CandidatePoC-in-GitHub · 0xAgun/CVE-2022-29464★ 10xAgun2022-04-22CandidatePoC-in-GitHub · dsssssssm/WSOB😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.★ 26dsssssssm2022-04-24CandidatePoC-in-GitHub · h3x0v3rl0rd/CVE-2022-29464★ 0h3x0v3rl0rd2022-04-24CandidatePoC-in-GitHub · lowkey0808/cve-2022-29464★ 0lowkey08082022-04-26CandidatePoC-in-GitHub · superzerosec/CVE-2022-29464CVE-2022-29464 POC exploit★ 2superzerosec2022-04-29CandidatePoC-in-GitHub · axin2019/CVE-2022-294641★ 1axin20192022-05-05CandidatePoC-in-GitHub · LinJacck/CVE-2022-29464cve-2022-29464 EXP★ 1LinJacck2022-05-07CandidatePoC-in-GitHub · sh4den/CVE-2022-29464A bots loader for CVE-2022-29464 with multithreading★ 10sh4den2022-05-15CandidatePoC-in-GitHub · Chocapikk/CVE-2022-29464Python script to exploit CVE-2022-29464 (mass mode)★ 5Chocapikk2022-05-26CandidatePoC-in-GitHub · jimidk/Better-CVE-2022-29464CVE-2022-29464 PoC for WSO2 products★ 5jimidk2022-06-04CandidatePoC-in-GitHub · hxlxmj/Mass-exploit-CVE-2022-29464Mass Exploit for CVE 2022-29464 on Carbon★ 1hxlxmj2022-06-28CandidatePoC-in-GitHub · Pasch0/WSO2RCECVE-2022-29464 Exploit★ 1Pasch02022-07-05CandidatePoC-in-GitHub · r4x0r1337/-CVE-2022-29464★ 4r4x0r13372022-08-01CandidatePoC-in-GitHub · amit-pathak009/CVE-2022-29464★ 0amit-pathak0092022-08-13CandidatePoC-in-GitHub · amit-pathak009/CVE-2022-29464-mass★ 1amit-pathak0092022-08-13CandidatePoC-in-GitHub · hupe1980/CVE-2022-29464WSO2 Arbitrary File Upload to Remote Command Execution (RCE)★ 3hupe19802022-09-22CandidatePoC-in-GitHub · gbrsh/CVE-2022-29464RCE exploit for WSO2★ 7gbrsh2022-11-14CandidatePoC-in-GitHub · devengpk/CVE-2022-29464★ 1devengpk2022-12-18CandidatePoC-in-GitHub · Ap0dexMe0/CVE-2022-29464Perform With Mass Exploits In WSO Management.★ 9Ap0dexMe02023-04-25CandidatePoC-in-GitHub · Pushkarup/CVE-2022-29464A PoC and Exploit for CVE 2022-29464★ 1Pushkarup2023-10-24CandidatePoC-in-GitHub · SynixCyberCrimeMy/CVE-2022-29464SynixCyberCrimeMY CVE Exploiter By SamuraiMelayu1337 & ?/h4zzzzzz.scc★ 0SynixCyberCrimeMy2023-11-16CandidatePoC-in-GitHub · cc3305/CVE-2022-29464CVE-2022-29464 exploit script★ 0cc33052024-06-07CandidatePoC-in-GitHub · c1ph3rbyt3/CVE-2022-29464★ 0c1ph3rbyt32025-01-17Candidatekitploit.comArbitrary file upload to RCE in WSO2 via JSP shell upload to target server.hi2026-10-10T00:31:29Candidate
CorrectionsReport an issue