CVE-2025-34510 - CVE House
Back to Database
Status published High CVE-2025-34510

Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Vulnerability Description

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34510

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Piotr Bazydlo of watchTowr

References

More from Sitecore

View All →
CVE-2025-53694
Information Disclosure in ItemServices API
High 7.5
CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
Critical 9.8
CVE-2025-53692
Sitecore Experience Platform Cross-Site Scripting Vulnerability
High 7.1
CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
High 8.8
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
Critical 9

Affected Vendor

Affected Software

Experience Manager, Experience Platform, Experience Commerce
Vulnerable Versions:
9.0, 10.0

Timeline

Official Publish: June 17th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-23

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1105 Ingress Tool Transfer
Command and Control
T1565 Data Manipulation
Impact