PT-2025-12671 · Kentico · Kentico Xperience

Piotr Bazydlo · Published 2025-03-24 · Updated 2026-04-22 · CVE-2025-2749

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kentico Xperience versions prior to 13.0.179

Description An authenticated remote code execution issue allows authenticated users of the Staging Sync Server to upload arbitrary data to path relative locations. This leads to path traversal and arbitrary file upload, enabling the upload of content that can be executed on the server side, resulting in remote code execution. This issue has been actively exploited in real-world incidents.

Recommendations Update to a version newer than 13.0.178.

Exploit

Fix

RCE

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2025-2749

Affected Products

Kentico Xperience

References · 17

• 🔥 https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms · Exploit
• https://osv.dev/vulnerability/CVE-2025-2749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2749 · Security Note
• https://devnet.kentico.com/download/hotfixes · Patch, Security Note, Vendor Advisory
• https://vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce · Note
• https://reddit.com/r/CVEWatch/comments/1ssh1lp/top_10_trending_cves_22042026 · Reddit Post
• https://t.me/cvedetector/20994 · Telegram Post
• https://twitter.com/cybercronai/status/1904851418906837221 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749 · Note
• https://twitter.com/ctiwatchcloud/status/2046438805142376950 · Twitter Post
• https://twitter.com/ScyScan/status/2046394390302843161 · Twitter Post
• https://t.me/cveNotify/139063 · Telegram Post
• https://t.me/cveNotify/139107 · Telegram Post
• https://twitter.com/__kokumoto/status/2046362934901928271 · Twitter Post
• https://t.me/cvetracker/19788 · Telegram Post