Kentico Xperience Remote Code Execution (RCE) via Path Traversal and Arbitrary File Upload (CVE-2025-2749)

1. Apply Official Patch

Upgrade to the latest secure version by applying the official hotfix from Kentico.

• Kentico Hotfixes Download Page

2. Temporary Mitigations

If immediate patching is not feasible, implement the following workarounds:

• Restrict Staging Sync Access: Restrict access to the Staging Sync Server endpoints using firewalls, VPNs, or IP address whitelisting.
• WAF Rules: Deploy Web Application Firewall (WAF) rules to detect and block path traversal sequences (e.g., ../, ..\) and unauthorized file upload attempts.
• Disable Execution Permissions: Disable script execution permissions (e.g., ASPX execution) on directories where user-uploaded files or staging sync files are processed.

This vulnerability in Kentico Xperience CMS stems from an authentication-bypass-adjacent or authenticated context where the Staging Sync Server allows users to upload arbitrary data to relative path locations. By leveraging Path Traversal (CWE-22) and Unrestricted Upload of File with Dangerous Type (CWE-434), an attacker can write files outside the designated upload directories.

If an attacker uploads executable server-side content (such as ASPX or ASHX files) into the web root, they can execute arbitrary commands under the context of the web server process. This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.