Vulnerability details
CVE-2025-2749
Actively exploited
Kentico Xperience
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
CVSS 3.1
7.2High
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2026-05-04)
Official description
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.2High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Kentico | Xperience | v ≤ 13.0.178 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ technical-descriptionexploit
- https://devnet.kentico.com/download/hotfixes vendor-advisorypatch
- https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-03-24
- Last updated
- 2026-04-21
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 84 · Critical
CISA KEV catalog
- Date added
- 2026-04-20
- Due date
- 2026-05-04
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
4.02%
Probability of exploitation in 30 days
90.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-434Unrestricted Upload of File with Dangerous Type