PT-2025-52295 · Kentico · Xperience

Published 2025-12-18 · Updated 2025-12-18 · CVE-2019-25229

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kentico Xperience (affected versions not specified)

Description An unrestricted file upload issue allows authenticated users with 'Read data' permissions to upload arbitrary file types through MVC form file uploader components. Attackers can manipulate file names to upload potentially malicious files to the system, leading to unauthorized file uploads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-25229

Affected Products

Xperience

References · 4

• https://osv.dev/vulnerability/CVE-2019-25229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25229 · Security Note
• https://vulncheck.com/advisories/kentico-xperience-mvc-forms-unrestricted-file-upload · Note
• https://devnet.kentico.com/download/hotfixes · Patch, Vendor Advisory