Remote Code Execution Vulnerability in Kentico Xperience
CVE-2025-2749
7.2HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-2749?
An authenticated vulnerability in Kentico Xperience allows authenticated users to exploit a flaw in the Staging Sync Server, enabling them to upload arbitrary files to relative paths on the server. This flaw poses a serious risk as it facilitates path traversal and arbitrary file uploads, permitting attackers to execute potentially malicious content on the server side.
Affected Version(s)
Xperience 0 <= 13.0.178
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.