CVE-2025-2749: Kentico Xperience path traversal and file upload lead to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw enables authenticated remote code execution, has a public exploit write-up, and is listed in CISA KEV, though exploitation requires a privileged Staging Sync Server account.

What it is

Kentico Xperience through 13.0.178 allows an authenticated Staging Sync Server user to upload arbitrary data to relative paths, enabling path traversal and unrestricted file upload. Because uploaded content can be executed server side, this results in authenticated remote code execution. The flaw combines CWE-22 and CWE-434 and is now listed in CISA KEV, so it warrants prompt remediation.

Impact

An attacker with Staging Sync Server access can write files outside intended directories and place executable content on the server, gaining remote code execution in the application context. That can lead to full compromise of the Kentico instance and any data or credentials it can reach.

Attack surface

The vulnerability is network reachable (AV:N) and requires high privileges (PR:H) with no user interaction (UI:N), meaning an attacker must already hold an authenticated Staging Sync Server account. It is reached through the staging sync upload functionality rather than an unauthenticated endpoint.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog with a due date of 2026-05-04, and a public exploit write-up is referenced, indicating active exploitation. EPSS is 0.03986 (89.98th percentile), so exploitation is plausible but not extremely likely in the next 30 days.

What to do

• Apply the vendor hotfix for Kentico Xperience through 13.0.178 from the Kentico devnet hotfix page.
• If patching is not immediately possible, restrict or disable Staging Sync Server access and limit it to trusted administrative networks.
• Audit and remove unnecessary Staging Sync Server accounts, enforcing least privilege and strong authentication.
• Monitor and restrict write permissions for the web application account so it cannot write executable files to web-accessible directories.
• Follow CISA BOD 22-01 guidance for cloud services or discontinue use if mitigations are unavailable.

Detection

• Review web server and application logs for staging sync upload requests that include path traversal sequences such as ../ or encoded variants.
• Monitor file system changes in web-accessible directories for newly created executable files (for example .aspx, .ashx, .asmx) originating from the Kentico application account.
• Alert on unusual Staging Sync Server authentication or upload activity from unexpected source IPs or outside normal administrative windows.
• Correlate Kentico staging sync events with subsequent process creation or outbound network connections from the web server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.