Remote Code Execution Vulnerability in Kentico Xperience
CVE-2025-2749

7.2HIGH

Key Information:

Vendor

Kentico

Status
Xperience
Vendor
CVE Published:
24 March 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-2749?

An authenticated vulnerability in Kentico Xperience allows authenticated users to exploit a flaw in the Staging Sync Server, enabling them to upload arbitrary files to relative paths on the server. This flaw poses a serious risk as it facilitates path traversal and arbitrary file uploads, permitting attackers to execute potentially malicious content on the server side.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Xperience 0 <= 13.0.178

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-2749 - Proof of Concept

References

https://labs.watchtowr.com/bypassing-authentication-like-...
technical-descriptionexploit
https://devnet.kentico.com/download/hotfixes
vendor-advisorypatch
https://www.vulncheck.com/advisories/kentico-xperience-st...
third-party-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

JSON
.