Kentico Xperience CVE-2025-2749
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
AnalysisAI
Remote code execution in Kentico Xperience CMS versions through 13.0.178 allows authenticated administrators to upload arbitrary files to controlled server paths via path traversal in the Staging Sync Server component. Confirmed actively exploited in the wild (CISA KEV). Public exploit available with detailed bypass techniques. EPSS score of 1.23% (79th percentile) suggests targeted exploitation rather than widespread scanning. While CVSS 7.2 requires high-privilege (administrator) authentication, active exploitation status makes this a priority for organizations running Kentico CMS.
Technical ContextAI
Kentico Xperience is an ASP.NET-based enterprise CMS and digital experience platform. The vulnerability resides in the Staging Sync Server module, which handles content synchronization between environments. The flaw is rooted in CWE-22 (Path Traversal) where the application fails to properly sanitize user-supplied file paths during upload operations. Attackers can manipulate relative path parameters (e.g., '../../../') to write files outside intended directories. By uploading executable content such as ASPX web shells to web-accessible locations, attackers achieve server-side code execution with the privileges of the IIS application pool. The CPE identifier cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:* confirms the Xperience product line is affected through version 13.0.178. The CVSS vector (AV:N/AC:L) indicates network-accessible exploitation with low complexity once authenticated access is obtained.
RemediationAI
Apply the vendor-released hotfix immediately from Kentico DevNet (https://devnet.kentico.com/download/hotfixes) to upgrade beyond version 13.0.178. Kentico provides version-specific patches through their support portal requiring authenticated access. If immediate patching is not feasible, disable the Staging Sync Server module entirely in web.config or IIS application settings until patching can occur - this prevents exploitation but breaks content synchronization workflows between staging and production environments. Restrict network access to Staging Sync endpoints using IP allowlisting at firewall or web application firewall level, permitting only known synchronization server IPs. Audit all administrator accounts for compromise and reset credentials, as the authentication requirement means attackers likely obtained or bypassed admin credentials. Review IIS logs and file system for suspicious ASPX uploads in non-standard directories, checking for web shells created post-exploitation. Note that disabling Staging Sync impacts content deployment workflows and may require manual promotion processes.
Share
External POC / Exploit Code
Leaving vuln.today