CVE-2024-46938: Sitecore unauthenticated arbitrary file read
The short version: Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) — versions 8.0 through 10.4 — have a flaw (CVE-2024-46938) that lets an unauthenticated attacker read arbitrary files from the server. On its own it's information disclosure; because those files include web.config (and its machine keys), it's a well-documented stepping stone to remote code execution via ViewState deserialization. Steady hands — patch, and keep Sitecore off the open internet.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — unauthenticated file read with a documented path to RCE |
| CVSS v3.1 (NVD/CISA-ADP) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 46.08% · 98.7th percentile (2026-07-17) |
| In CISA KEV? | No — not listed at time of writing (our library flagged it; we could not confirm a KEV entry) |
| Known exploited? | Not confirmed at time of writing |
| Vulnerability type | CWE-200 exposure of sensitive information via path traversal → unauthenticated arbitrary file read |
| Requires authenticated session? | No — pre-authentication |
| Affected | Sitecore XP, XM, and XC 8.0 (Initial Release) through 10.4 (Initial Release) |
| Fixed in | Apply the vendor's fix per Sitecore KB1003408 |
What you need to know
The bug is a path traversal in a Sitecore endpoint that serves bundled resources. By supplying a crafted path (traversing up from the resource directory to, say, web.config), an unauthenticated attacker retrieves files that should be off-limits — the response contains the file contents (for example, a <configuration> block).
That's why the "just a file read" framing understates it. As Assetnote's research documented, reading web.config yields the ASP.NET machine keys, and with those an attacker can forge a valid __VIEWSTATE payload — turning the file read into ViewState deserialization RCE. The one practical precondition is knowing the absolute installation path so the traversal resolves, which is often discoverable.
- It's pre-authentication and network-reachable. No credentials, no user interaction to trigger the read.
- The impact ceiling is high. File read here is a means to code execution, not the end of the story.
How serious we see it
Moderate — impact-led.
On paper NVD scores this 7.5 as confidentiality-only, and taken literally that's a file read. Taken as it's used — a route to machine keys and ViewState RCE on an internet-facing CMS — it deserves more urgency than the band suggests. We land on High rather than Critical because we could not confirm it in CISA's KEV catalog or find public evidence of active in-the-wild exploitation at time of writing, and because the traversal needs the install path to line up. That's a reason to prioritize sensibly, not to relax: the fix exists, the affected range is clear, and exposure is quick to confirm.
Recommendations
Straight from Sitecore's guidance:
- Patch now. Apply Sitecore's fix per KB1003408 for your XP/XM/XC version.
- Rotate machine keys if exposed. If you have reason to believe
web.configwas read, regenerate ASP.NET machine keys to invalidate any forged ViewState. - Get the CMS admin surface off the open internet. Restrict management interfaces to trusted networks; front the site with a WAF where practical.
- Hunt for prior use. Review logs for traversal requests to resource/bundle endpoints and for anomalous ViewState activity.
- Confirm your exposure first. Verify whether you run Sitecore XP/XM/XC in the 8.0–10.4 range and which build.
How BreachRisk sees it
BreachRisk discovers internet-facing Sitecore instances from little more than your domain, fingerprints the platform, and flags exposure tied to this flaw. Where testing is authorized, BreachRisk can safely confirm whether the traversal actually returns protected content — a bounded check that reads a benign marker, not a secrets grab — turning "this is Sitecore" into a verified, prioritized finding.
That outside-in view is what you want for a file-read bug that quietly becomes RCE: the exposed CMS is already mapped, so you can sequence the patch before someone lifts your machine keys.