CVE-2025-2749 Kentico Xperience
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed…
- CVSS
- 7.2 High
- EPSS
- 4.0%
- Percentile
- 91
- Published
- 2025-03-24
- Force
- 9 of 12
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
Kentico Xperience Path Traversal Vulnerability
- Added
- 2026-04-20
- Federal patch deadline
- 2026-05-04
- Ransomware use
- not known