CVE-2025-34511
Published: 17 June 2025
Summary
CVE-2025-34511 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Sitecore Experience Platform. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Sitecore PowerShell Extensions, an add-on for Sitecore Experience Manager (XM) and Experience Platform (XP) through version 7.0, contains an unrestricted file upload vulnerability tracked as CVE-2025-34511. The flaw, assigned CWE-434, permits crafted HTTP requests to place arbitrary files on the server and carries a CVSS 3.1 score of 8.8.
A remote attacker who already possesses valid credentials can exploit the issue to upload and execute malicious files, resulting in full remote code execution on the affected Sitecore instance. The attack requires no user interaction and can be performed over the network with low attack complexity.
Public references include a Watchtowr Labs technical write-up and the official Sitecore knowledge-base article KB1003667, which address mitigation steps and available patches. The EPSS score currently stands at 0.8578 with a recorded peak of 0.8609, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-18568
Vulnerability details
Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests,…
more
resulting in remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.