CVE-2025-2749

The vulnerability in Kentico Xperience arises from an authenticated remote code execution flaw that allows users with sufficient permissions to upload arbitrary data to relative paths on the server. This issue is particularly concerning as it facilitates path traversal, enabling attackers to manipulate file paths and potentially upload malicious files to locations where they can be executed. The flaw is present in versions up to 13.0.178, making it critical for organizations utilizing this content management system to assess their exposure. The underlying weakness stems from inadequate validation of user input, specifically in the context of file uploads, which can lead to unauthorized access to sensitive directories and execution of arbitrary code.

Attack vectors for this vulnerability are multifaceted. An authenticated user, such as a content editor or administrator, could exploit the flaw by uploading a crafted file that contains malicious code. This could be achieved through the Staging Sync Server functionality, which is intended for synchronizing content across environments. Once the malicious file is uploaded, the attacker can trigger its execution, potentially gaining control over the server or accessing sensitive data. Scenarios may include uploading web shells, which allow for persistent access, or other payloads that could facilitate further attacks within the network. Given that the exploit requires only authenticated access, the risk is exacerbated in environments where user permissions are not tightly controlled.

The real-world impact of this vulnerability can be severe, particularly for organizations that rely on Kentico Xperience for their web applications. Successful exploitation could lead to unauthorized access to sensitive data, disruption of services, and significant reputational damage. The ability to execute arbitrary code on the server opens the door to a range of malicious activities, including data exfiltration, defacement of web applications, and lateral movement within the network. The business risk is heightened for organizations in regulated industries, where data breaches can result in substantial fines and legal repercussions. Furthermore, the potential for operational downtime and the costs associated with incident response can have lasting financial implications.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regular security assessments, including penetration testing and code reviews, can help identify weaknesses in the application and its configuration. Additionally, organizations should enforce strict access controls to limit the number of authenticated users who can upload files, ensuring that only trusted personnel have the ability to perform such actions. Input validation and sanitization should be prioritized to prevent path traversal attacks, and file upload mechanisms should be configured to restrict the types of files that can be uploaded. Employing web application firewalls (WAFs) can also provide an additional layer of protection by monitoring and filtering out malicious requests.

In conclusion, the vulnerability in Kentico Xperience poses a significant threat to organizations using this platform. The potential for remote code execution through authenticated access highlights the need for robust security practices and vigilant monitoring. By understanding the technical details, attack vectors, and real-world implications, organizations can better prepare themselves to defend against such vulnerabilities. Implementing effective detection and mitigation strategies will be crucial in safeguarding sensitive data and maintaining the integrity of web applications.

CSURFACE threat intelligence has identified a marked escalation in activity related to CVE-2025-2749, evidenced by new detections and its recent inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. This formal recognition by CISA underscores the vulnerability’s elevated risk profile and signals increased attention from both defenders and threat actors. Concurrently, the vulnerability’s CVSS score has been updated to 7.2, reflecting its high severity and potential impact. Our telemetry further indicates a significant rise in the Exploit Prediction Scoring System (EPSS) score, now positioned in the upper percentile with a rapidly increasing trend, suggesting growing exploitation attempts or proof-of-concept activity in the wild. Although no new exploit details have surfaced, these developments collectively heighten the urgency for defenders to prioritize monitoring and response efforts. The evolving threat landscape around this authenticated remote code execution vulnerability in Kentico Xperience demands reassessment of risk, as the likelihood of exploitation is demonstrably increasing, thereby elevating the overall threat level to high.

Update 2 — May 16, 2026

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2025-2749, with telemetry indicating a doubling in detection frequency over recent monitoring periods. Despite this surge, the Exploit Prediction Scoring System (EPSS) score has decreased significantly, reflecting a complex dynamic where increased detection may stem from heightened scanning or proof-of-concept testing rather than widespread exploitation. The vulnerability’s inclusion in the Known Exploited Vulnerabilities (KEV) catalog underscores its recognized risk, yet no new exploit techniques or ransomware affiliations have been identified to date. This divergence between rising detection signals and a declining EPSS score suggests that while adversaries are actively probing or validating the flaw, large-scale exploitation campaigns have not yet materialized. For defenders, this evolving pattern necessitates sustained vigilance as the vulnerability remains a credible threat vector with potential for escalation. Consequently, the overall threat level remains high, with an emphasis on monitoring for any shifts toward more aggressive exploitation behaviors.