Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-2749 is a high-severity Path Traversal (CWE-22) vulnerability in Kentico Xperience. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-2749 is an authenticated remote code execution vulnerability affecting Kentico Xperience through version 13.0.178. It stems from improper handling of file uploads in the Staging Sync Server component, enabling path traversal (CWE-22) combined with unrestricted upload of dangerous file types (CWE-434). An authenticated user can supply arbitrary data to relative paths, resulting in server-side executable content being written to the filesystem.
An attacker with valid high-privilege credentials on the Staging Sync Server can exploit the flaw over the network to upload and execute arbitrary code, achieving full remote code execution with impacts to confidentiality, integrity, and availability. The CVSS 7.2 score reflects the requirement for authentication while noting the low attack complexity once credentials are obtained.
Kentico has published hotfixes addressing the issue through its DevNet download portal. The vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, confirming observed in-the-wild activity, while third-party analyses from WatchTowr Labs and VulnCheck provide additional technical context on the upload and traversal mechanics.
EPSS for this CVE rose materially from lower values to a peak of 0.1366 on 2026-04-21 before receding to the current 0.0477, indicating that exploitation interest increased after public disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8010
Vulnerability Data
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading…
more
to remote code execution.This issue affects Kentico Xperience through 13.0.178.
- CWE(s)
- KEV Date Added
- See CISA KEV catalog
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V5.1.1
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly neutralizes special path elements before pathname construction occurs.
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Least functionality restricts the file types and automatic processing capabilities the system will accept.
Mobile-code controls define, authorize, and block unacceptable uploaded code before automatic processing occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Hardened configuration baselines can enforce allowed file types and processing rules.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
Secure development practices include input validation and file-type restrictions that prevent this weakness.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.