EUVD-2025-18568
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.
Analysis
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX webshells via crafted HTTP requests. The unrestricted file upload bypasses content type restrictions, enabling remote code execution on the Sitecore IIS server with any authenticated account.
Technical Context
Sitecore PowerShell Extensions (SPE) adds PowerShell scripting capabilities to the Sitecore CMS. The file upload functionality fails to properly restrict uploaded file types, allowing .aspx files to be uploaded and placed in web-accessible directories. An attacker with any authenticated Sitecore account can upload a webshell that executes with the IIS application pool identity.
Affected Products
['Sitecore PowerShell Extensions <= 7.0', 'Sitecore XM/XP with SPE installed']
Remediation
Update Sitecore PowerShell Extensions beyond version 7.0. Restrict SPE access to trusted administrators only. Configure IIS to prevent script execution in upload directories. Monitor Sitecore file system for unexpected .aspx file creation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today