# CVE-2025-2749

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.

- Page: https://www.vulneraibility.com/cve/CVE-2025-2749
- CVSS: 7.2
- Known exploited: yes, in CISA KEV since 2026-04-20; CISA due date 2026-05-04
- EPSS: 4.02%
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2026-04-20)
- Weakness: CWE-22, CWE-434
- Published: 2025-03-24

## Affected versions

- Kentico Xperience: affected <= 13.0.178

A version outside these ranges is not a statement that it is unaffected.

## References

- [exploit] https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
- [patch] https://devnet.kentico.com/download/hotfixes
- [advisory] https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.