High severity7.2CISA KEVNVD Advisory· Published Mar 24, 2025· Updated Apr 21, 2026

CVE-2025-2749

Description

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kentico/Xperience2 versions
cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*range: <=13.0.178
- (no CPE)range: <=13.0.178

Patches

Vulnerability mechanics

References

devnet.kentico.com/download/hotfixesnvdPatch
labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/nvdExploitThird Party Advisory
www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rcenvdThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.003
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000