---
id: CVE-2025-13647
title: >-
  Information Disclosure in Multiple WSO2 Products Allows Exposure of
  Certificate File Paths
summary: >-
  The affected component fails to enforce expected validation constraints on the
  `content-type` header when processing certain requests. This allows an
  attacker to submit a crafted request with a manipulated `content-type` header.


  Success…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: WSO2
product: WSO2 Identity Server
affected:
  - identity_server >= 5.10.0 < 5.10.0.381
  - identity_server >= 5.11.0 < 5.11.0.428
  - identity_server >= 6.0.0 < 6.0.0.255
  - identity_server >= 6.1.0 < 6.1.0.255
  - identity_server >= 7.0.0 < 7.0.0.133
  - identity_server >= 7.1.0 < 7.1.0.41
  - identity_server >= 7.2.0 < 7.2.0.3
  - open_banking_iam >= 2.0.0 < 2.0.0.421
  - identity_server_as_key_manager >= 5.10.0 < 5.10.0.372
  - >-
    org.wso2.carbon.identity.api.server.keystore.management.common >= 1.0.82 <
    1.0.82.25
  - >-
    org.wso2.carbon.identity.api.server.keystore.management.common >= 1.0.190 <
    1.0.190.17
  - >-
    org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.3 <
    1.2.3.6
  - >-
    org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.23 <
    1.2.23.10
  - >-
    org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.176 <
    1.2.176.18
  - >-
    org.wso2.carbon.identity.api.server.keystore.management.common >= 1.3.83 <
    1.3.83.10
  - >-
    org.wso2.carbon.identity.api.server.keystore.management.common >= 1.3.213 <
    1.3.213.1
  - >-
    org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1
    >= 1.0.82 < 1.0.82.25
  - >-
    org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1
    >= 1.0.190 < 1.0.190.17
  - >-
    org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1
    >= 1.2.3 < 1.2.3.6
  - >-
    org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1
    >= 1.2.23 < 1.2.23.10
  - >-
    org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1
    >= 1.2.176 < 1.2.176.18
  - >-
    org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1
    >= 1.3.83 < 1.3.83.10
  - >-
    org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1
    >= 1.3.213 < 1.3.213.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T19:20:07.726881Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:20:26.022Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-13647'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/
tags:
  - cve.org
epss: 0.00183
epssPercentile: 0.07953
ingestedAt: '2026-11-05T19:30:42.790Z'
---

## Overview

The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.

Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.

## Affected

- `identity_server >= 5.10.0 < 5.10.0.381`
- `identity_server >= 5.11.0 < 5.11.0.428`
- `identity_server >= 6.0.0 < 6.0.0.255`
- `identity_server >= 6.1.0 < 6.1.0.255`
- `identity_server >= 7.0.0 < 7.0.0.133`
- `identity_server >= 7.1.0 < 7.1.0.41`
- `identity_server >= 7.2.0 < 7.2.0.3`
- `open_banking_iam >= 2.0.0 < 2.0.0.421`
- `identity_server_as_key_manager >= 5.10.0 < 5.10.0.372`
- `org.wso2.carbon.identity.api.server.keystore.management.common >= 1.0.82 < 1.0.82.25`
- `org.wso2.carbon.identity.api.server.keystore.management.common >= 1.0.190 < 1.0.190.17`
- `org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.3 < 1.2.3.6`
- `org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.23 < 1.2.23.10`
- `org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.176 < 1.2.176.18`
- `org.wso2.carbon.identity.api.server.keystore.management.common >= 1.3.83 < 1.3.83.10`
- `org.wso2.carbon.identity.api.server.keystore.management.common >= 1.3.213 < 1.3.213.1`
- `org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.0.82 < 1.0.82.25`
- `org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.0.190 < 1.0.190.17`
- `org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.2.3 < 1.2.3.6`
- `org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.2.23 < 1.2.23.10`
- `org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.2.176 < 1.2.176.18`
- `org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.3.83 < 1.3.83.10`
- `org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.3.213 < 1.3.213.1`

## Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution