Unrestricted File Upload Vulnerability in Kentico Xperience

CVE-2019-25229

What is CVE-2019-25229?

The vulnerability found in Kentico Xperience involves an unrestricted file upload mechanism that allows authenticated users with 'Read data' permissions to upload arbitrary file types. This occurs through MVC form file uploader components, where attackers can exploit file name manipulation to upload potentially malicious files. The resulting unauthorized file uploads pose significant risks to the integrity and security of the system.

References