CVE-2025-2749

Published Mar 24, 2025

Last updated 2 months ago

Zero-day

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-2749 describes an authenticated remote code execution vulnerability found in Kentico Xperience, affecting versions up to and including 13.0.178. This flaw allows authenticated users of the Staging Sync Server to upload arbitrary data to locations relative to the intended path. The vulnerability stems from improper limitation of a pathname, leading to path traversal and the ability to upload files of dangerous types. This arbitrary file upload can then be leveraged to execute code on the server side, ultimately resulting in remote code execution.

Description: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
Source: disclosure@vulncheck.com
NVD status: Analyzed
Products: xperience

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

disclosure@vulncheck.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BC749CC3-7A20-49C8-89FB-775818670734",
            "versionEndIncluding": "13.0.178",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.