CVE-2025-2749: Kentico Xperience path traversal and file upload leading to RCE
The short version: Kentico Xperience — a .NET content-management and digital-experience platform — has a flaw (CVE-2025-2749) in its Staging Sync Server that allows arbitrary file upload to path-relative locations, and files that land in a server-executable path yield remote code execution. It's in CISA's KEV catalog. If you run Kentico Xperience through 13.0.178, apply the current hotfix and lock down the staging service. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — file upload to RCE on a public-facing CMS, KEV-listed |
| CVSS v3.1 (NVD) | 7.2 — High · AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (assessed by VulnCheck, CNA; NVD had not published its own base score at time of writing) |
| EPSS | ~3.85% · 88.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2026-05-04 |
| Known exploited? | Yes — added to KEV on known-exploited grounds |
| Vulnerability type | CWE-22 path traversal + CWE-434 unrestricted file upload → remote code execution |
| Requires authenticated session? | Staging Sync Server access is required; researchers demonstrated pre-auth chains reaching it |
| Affected | Kentico Xperience through 13.0.178 |
| Fixed in | Unknown at time of writing — apply the current Kentico hotfix (see Kentico's hotfix download) |
What you need to know
Kentico Xperience runs public websites, so an internet-facing instance is normal. The weakness is in the Staging Sync Server, the component that synchronizes content between environments. CVE-2025-2749 lets an attacker upload data to path-relative locations; because the traversal can place a file where the server will execute it, arbitrary file upload becomes remote code execution in the context of the web application.
- It's a public-facing CMS. Code execution reaches the site and the server that hosts it.
- The staging endpoint is the way in. Where the Staging Sync Server is reachable — and researchers have shown pre-authentication chains that get there — the upload path is exposed.
- It's KEV-listed. The theoretical is operational; CISA set a remediation deadline.
How serious we see it
High — file upload to code execution on an internet-facing content platform, confirmed exploited enough to earn a KEV listing.
The base score sits at 7.2 largely because the direct flaw assumes access to the staging service, but public research demonstrated chains that reach it without valid credentials — which is why we treat it as a High rather than a middling authenticated bug. The bounded, reassuring part: it affects a specific product below a specific build, a hotfix exists, and you can quickly tell whether you run Kentico Xperience and expose staging.
Recommendations
- Patch now. Apply the current Kentico Xperience hotfix from Kentico's hotfix download; do not remain on 13.0.178 or earlier.
- Restrict the Staging Sync Server. If you don't use content staging, disable it; if you do, restrict it to trusted networks and require authentication.
- Hunt. Review the web root and upload/staging paths for files you didn't place, and check application logs for unexpected staging requests.
- If compromised, respond. Rebuild the affected server, rotate application secrets and the ASP.NET machine key, and review for persistence.
- Confirm your exposure first. Verify whether you run Kentico Xperience and whether the staging endpoint is reachable.
How BreachRisk sees it
BreachRisk discovers internet-facing Kentico Xperience sites from little more than your domain, fingerprints the platform, and flags exposure tied to this KEV-listed flaw — pushed up your results because it's actively exploited. We detect and prioritize the exposed, affected instance; the continuous outside-in view means a public CMS running a known-exploited build is already on your radar, not buried in a scanner backlog.