CVE-2025-2749

HIGH CISA KEV EPSS 88.8%
Published Mar 24, 20251y ago · Modified Jun 17, 20262w ago
7.2 CVSS 3.1
High
Find Similar
Published Mar 24, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Apr 20, 2026 2mo ago
KEV Due May 4, 2026 59d overdue

Description

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.

CVSS Details

Base Score
7.2
Exploitability
1.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 59d
Added
Apr 20, 2026
Due
May 4, 2026

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
88.8% percentile
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 1

VendorProductVersionRange
kenticoxperience* ≤13.0.178

References 4

  • devnet.kentico.com https://devnet.kentico.com/download/hotfixes
    Patch
  • labs.watchtowr.com https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
    ExploitThird Party Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749
    US Government Resource
  • vulncheck.com https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce
    Third Party Advisory

Remediation