Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
Only Kentico Xperience up to 13.0.178 is listed, and only when the Staging (Sync) Service is enabled and uses username/password authentication rather than X.509. The fix is in 13.0.178.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 13.0.178
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Kentico Xperience, a web content management platform, is affected by this vulnerability. An authenticated user can upload files to arbitrary locations on the server, which can allow them to execute code remotely.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- Kentico Xperience
through 13.0.178
References 3
labs.watchtowr.com
devnet.kentico.com
Questions about CVE-2025-2749
What does this mean?
A logged-in user can upload a media file through the Staging service, which can lead to code running on the server. The flaw is in how that upload is handled.Source: labs.watchtowr.com, vulncheck.com
Am I affected, and how do I check?
The listed range is Kentico Xperience up to and including 13.0.178. The issue applies only when the Staging (Sync) Service is enabled, which is off by default, and it is configured with username/password authentication; the X.509 option is not affected. Check the installed Xperience version and the Staging Service authentication setting to compare against these conditions.Source: labs.watchtowr.com, vulncheck.com
What should I do about it?
Upgrade to Kentico Xperience 13.0.178, which the advisory says resolves WT-2025-0011. The affected range is also given as up to and including 13.0.178, so check the vendor advisory for the exact fixed build.Source: labs.watchtowr.com, vulncheck.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-20, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data