CVE-2025-2749highunder attackCWE-22CWE-434

CVE-2025-2749: high-severity vulnerability in Kentico Xperience

Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE

Published · Updated

Follow this CVE+ Monitor Xperience

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.2epss 4.0%
from disclosure to weapon
Published on NVDMar 24
CISA KEV+392d
Action required by CISAfederal deadline: 2026-05-04

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An authenticated user with Staging Sync Server access in Kentico Xperience can upload files to unintended locations on the server, potentially placing executable code that runs on the server. This allows attackers with valid credentials to take control of the affected system.

Technical detail

Authenticated path traversal vulnerability in Kentico Xperience ≤13.0.178 Staging Sync Server allows users to upload arbitrary files to attacker-controlled paths via insufficient input validation (CWE-22, CWE-434). Successful exploitation results in arbitrary file write and remote code execution with server privileges; requires valid authentication credentials.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Kentico · Xperience
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Kentico Xperience

In the same product, most dangerous first.

CVE-2025-2747CRITICALKentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication BypassEPSS 97.2%KEVCVE-2025-2746CRITICALKentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication BypassEPSS 74.1%KEVCVE-2025-2748MEDIUMKentico Xperience stored cross-site scripting in multiple-file upload functionalityEPSS 60.6%CVE-2025-32370HIGHCVE-2025-32370EPSS 1.6%CVE-2025-2794HIGHKentico Xperience <= 13.0.180 Unsafe ReflectionEPSS 0.5%CVE-2023-53934HIGHKentico Xperience <= 12.0.98 GetResource Handler Denial of ServiceEPSS 0.4%