CVE-2025-2749KEV · OVERDUECWE-22CWE-434

Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE

High · published March 24, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 90.5th percentile for exploit probability.

173
days past CISA
deadline
CVSS v3.1
7.2
EPSS
4%
Percentile
90.5
In the wild
Confirmed
What it is

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04021 · 90.5th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-03-24T18:18Z
KEV added
2026-04-20 · due 2026-05-04
EPSS history
Timeline
  • 20 APR 00:00Z
    Added to CISA KEV — remediate by May 4
    kev
  • 24 MAR 18:18Z
    Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
    cvelistv5