Xperience
CVE-2025-2749
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
AnalysisAI
Remote code execution in Kentico Xperience CMS versions through 13.0.178 allows authenticated administrators to upload arbitrary files to controlled server paths via path traversal in the Staging Sync Server component. Confirmed actively exploited in the wild (CISA KEV). Public exploit available with detailed bypass techniques. EPSS score of 1.23% (79th percentile) suggests targeted exploitation rather than widespread scanning. While CVSS 7.2 requires high-privilege (administrator) authentication, active exploitation status makes this a priority for organizations running Kentico CMS.
Technical ContextAI
Kentico Xperience is an ASP.NET-based enterprise CMS and digital experience platform. The vulnerability resides in the Staging Sync Server module, which handles content synchronization between environments. The flaw is rooted in CWE-22 (Path Traversal) where the application fails to properly sanitize user-supplied file paths during upload operations. Attackers can manipulate relative path parameters (e.g., '../../../') to write files outside intended directories. By uploading executable content such as ASPX web shells to web-accessible locations, attackers achieve server-side code execution with the privileges of the IIS application pool. The CPE identifier cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:* confirms the Xperience product line is affected through version 13.0.178. The CVSS vector (AV:N/AC:L) indicates network-accessible exploitation with low complexity once authenticated access is obtained.
RemediationAI
Apply the vendor-released hotfix immediately from Kentico DevNet (https://devnet.kentico.com/download/hotfixes) to upgrade beyond version 13.0.178. Kentico provides version-specific patches through their support portal requiring authenticated access. If immediate patching is not feasible, disable the Staging Sync Server module entirely in web.config or IIS application settings until patching can occur - this prevents exploitation but breaks content synchronization workflows between staging and production environments. Restrict network access to Staging Sync endpoints using IP allowlisting at firewall or web application firewall level, permitting only known synchronization server IPs. Audit all administrator accounts for compromise and reset credentials, as the authentication requirement means attackers likely obtained or bypassed admin credentials. Review IIS logs and file system for suspicious ASPX uploads in non-standard directories, checking for web shells created post-exploitation. Note that disabling Staging Sync impacts content deployment workflows and may require manual promotion processes.
Kentico Xperience contains a second authentication bypass in the Staging Sync Server through None-type password handling
Kentico Xperience through 13.0.172 contains an authentication bypass in the Staging Sync Server through empty SHA1 usern
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions
Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password fie
Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuratio
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary op
Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certai
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload function
The Kentico Xperience CMS version 13.0 - 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/for
An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process,
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today