Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
Vulnerability Description
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2749
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Piotr Bazydlo (watchTowr)
References
More from Kentico
View All →Affected Vendor
Kentico
View all reports →