CVE-2025-34510CWE-23

Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

High · published June 17, 2025

CVSS v3.1

8.8

EPSS

25%

Percentile

97.9

In the wild

Unconfirmed

What it is

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.24835 · 97.9th percentile
Weakness: CWE-23 · Relative Path Traversal
Published: 2025-06-17T18:46Z

EPSS history

Timeline

17 JUN 18:46Z
Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
cvelistv5