PT-2025-12670 · Kentico · Kentico Xperience

Piotr Bazydlo · Published 2025-03-24 · Updated 2025-12-27 · CVE-2025-2748

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kentico Xperience versions prior to 13.0.178

Description The Kentico Xperience application does not fully validate or filter files uploaded through the multiple-file upload functionality. This insufficient validation allows for stored Cross-Site Scripting (XSS). Exploitation of this issue can potentially lead to Remote Code Execution (RCE) by abusing custom file handlers. The vulnerability is triggered by uploading specially crafted files, such as ZIP archives containing malicious SVG files, which can then be used to execute arbitrary JavaScript code.

Recommendations Versions prior to 13.0.178 should be updated to version 13.0.178 or later.

Fix

RCE

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2025-2748

Affected Products

Kentico Xperience

References · 29

• https://nvd.nist.gov/vuln/detail/CVE-2025-2748 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2748 · Vendor Advisory
• https://twitter.com/gothburz/status/1909017220371435743 · Twitter Post
• https://t.me/cvedetector/20993 · Telegram Post
• https://twitter.com/_r_netsec/status/1909999267915485458 · Twitter Post
• https://twitter.com/tbbhunter/status/1909343159185736012 · Twitter Post
• https://twitter.com/gothburz/status/1909017131309555755 · Twitter Post
• https://t.me/thebugbountyhunter/9788 · Telegram Post
• https://twitter.com/CVEnew/status/1904243653629051059 · Twitter Post
• https://t.me/rnetsec/21414 · Telegram Post
• https://t.me/cveNotify/146938 · Telegram Post
• https://t.me/cybersecuritytechnologies/12011 · Telegram Post
• https://twitter.com/_r_netsec/status/1907013344005165242 · Twitter Post
• https://twitter.com/Dinosn/status/1907030674520842656 · Twitter Post
• https://twitter.com/samilaiho/status/1907400690852315566 · Twitter Post