CVE-2025-2749
Published: 24 March 2025
Summary
CVE-2025-2749 is a high-severity Path Traversal (CWE-22) vulnerability in Kentico Xperience. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely application of Kentico hotfixes to remediate the path traversal and arbitrary file upload leading to RCE.
Prevents path traversal and invalid file uploads in the Staging Sync Server by validating user-supplied paths and filenames against allowed patterns.
Restricts uploads to safe file types and classes of data, blocking dangerous server-executable content exploited via the Staging Sync Server.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing Kentico Xperience web app enables authenticated RCE via path traversal and arbitrary file upload of server-side executables, directly facilitating exploitation of public-facing applications and deployment of web shells.
NVD Description
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading…
more
to remote code execution.This issue affects Kentico Xperience through 13.0.178.
Deeper analysisAI
CVE-2025-2749 is an authenticated remote code execution vulnerability in Kentico Xperience. It enables authenticated users with access to the Staging Sync Server to upload arbitrary data to path-relative locations, resulting in path traversal and arbitrary file upload, including server-side executable content that leads to remote code execution. This issue affects Kentico Xperience versions through 13.0.178 and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H), mapped to CWE-22 (Path Traversal) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
The vulnerability can be exploited by authenticated users possessing high privileges (PR:H) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N) required. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the same security scope (S:U), specifically by executing arbitrary code on the server.
Kentico provides hotfixes via their devnet download portal for mitigation. Advisories from VulnCheck detail the Staging Media file upload mechanism enabling authenticated RCE, while Watchtower Labs describes authentication bypass techniques forming a pre-auth RCE chain. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) lists CVE-2025-2749 in its Known Exploited Vulnerabilities Catalog, indicating active real-world exploitation.
Security practitioners should prioritize patching affected Kentico Xperience instances, given the confirmed exploitation status and potential for privilege escalation chains.
Details
- CWE(s)
- KEV Date Added
- See CISA KEV catalog