An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input SOAP admin services. A malicious actor with administrative privileges can an a user-controlled location on the server. By leveraging this vulnerability, attacker could specially crafted payload, potentially achieving remote code execution (RCE) server. Exploitation requires valid credentials, limiting its impact authorized but users.