- Description
- An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
- Source
- disclosure@vulncheck.com
- NVD status
- Analyzed
- Products
- xperience
CVSS 3.1
- Type
- Secondary
- Base score
- 7.2
- Impact score
- 5.9
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- disclosure@vulncheck.com
- CWE-22
- Hype score
- Not currently trending
CISAが既知の悪用された脆弱性8件をカタログに追加 https://t.co/pNkjqAkOwD CVE-2023-27351 PaperCut NG/MF 認証エラーの脆弱性 CVE-2024-27199 JetBrains TeamCity 相対パストラバーサル脆弱性 CVE-2025-2749 Kentico Xperienceのパストラバー
@cybersecnews_jp
21 Apr 2026
136 Impressions
0 Retweets
0 Likes
0 Bookmarks
2 Replies
0 Quotes
Warning: Path traversal vulnerability in #Kentico Xperience. #CVE-2025-2749 CVSS: 7.2. This #actively exploited vulnerability can be used to achieve remote code execution. #RCE! https://t.co/n1npvocidN #Patch #Patch #Patch
@CCBalert
21 Apr 2026
169 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Line 1: Kentico Xperience CMS Authenticated RCE (CVE-2025-2749) Line 2: Affected: Kentico Xperience through v13.0.178 Line 3: Risk: High-severity RCE via path traversal/file upload, requires auth but enables complete compromise Line 4: Actions: Patch immediately, review staging
@RedHornet_Intel
21 Apr 2026
3 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 [HIGH] Active exploitation detected: CVE-2025-2749 Exploit in the wild confirmed for CVE-2025-2749 (CVSS null). Kentico Xperience contains a path traversal vulnerability that could allow an authenticat... 🔗 https://t.co/RZBhpWnHFz #ZeroDay #ExploitInWild #CyberSecurity
@ctiwatchcloud
21 Apr 2026
165 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Latest Known Exploited Vulnerabilities (#KEV) : #CVE-2025-2749 #Kentico Xperience Path Traversal Vulnerability https://t.co/rDK0y1TExA
@ScyScan
21 Apr 2026
135 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CISAが既知の悪用された脆弱性8件をカタログに追加 CISA Adds Eight Known Exploited Vulnerabilities to Catalog #CISA (Apr 20) CVE-2023-27351 PaperCut NG/MF 認証エラーの脆弱性 CVE-2024-27199 JetBrains TeamCity 相対パストラバーサル脆弱性 C
@foxbook
21 Apr 2026
376 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-2749 🔴 HIGH (7.2) 🏢 Kentico - Xperience 🏗️ 0 🔗 https://t.co/6SellumW1y 🔗 https://t.co/FWBcbtoLpv #CyberCron #VulnAlert #InfoSec https://t.co/W4sdWu9F9G
@cybercronai
26 Mar 2025
5 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC749CC3-7A20-49C8-89FB-775818670734",
"versionEndIncluding": "13.0.178",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]