CVE-2025-2749

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-434

Affected software

Vendor	Product	Versions
Kentico	Xperience	<= 13.0.178

References

https://devnet.kentico.com/download/hotfixesPatch
https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/Exploit, Third Party Advisory
https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rceThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749US Government Resource

Timeline

Published: Mar 24, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 20, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-274907.8Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.CVE-2025-274917.1Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network.CVE-2025-274927.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized a CVE-2025-274936.7A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V CVE-2025-274947.2A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V CVE-2025-274959.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-274963.3Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver CVE-2025-274978.7OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the serv CVE-2025-274985.7aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertex CVE-2025-274996.1WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerab CVE-2025-27508.8A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CS CVE-2025-275006.1OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel ca