EUVD-2025-18525
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
Analysis
Sitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allows authenticated attackers to write arbitrary files outside the intended upload directory. By crafting ZIP archives with path traversal entries, attackers can overwrite application files and achieve remote code execution.
Technical Context
The file upload functionality accepts ZIP archives and extracts their contents without properly validating entry paths. By including entries with ../../ prefixes in the ZIP archive, an attacker can write files to arbitrary locations on the filesystem. Writing an ASPX webshell to the Sitecore web root achieves code execution. The vulnerability requires authentication but not administrative privileges.
Affected Products
['Sitecore XM/XP/XC 9.0 through 9.3', 'Sitecore XM/XP/XC 10.0 through 10.4']
Remediation
Apply the latest Sitecore security patch. Implement server-level controls to prevent file writes outside designated directories. Restrict upload permissions to trusted users. Monitor the web root for unexpected ASPX file creation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today