{"id":"CVE-2025-2749","kind":"vulnerability","aliases":["CVE-2025-2749"],"related":[],"title":"An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload…","description":"Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Kentico Xperience has a path traversal flaw in its Staging Sync Server that lets an authenticated user write files to arbitrary locations relative to the server's paths. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2026-04-20T00:00:00+00:00","products":[{"name":"Kentico Kentico Xperience","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"kentico xperience","fixed":[],"affected":"<= 13.0.178","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","kentico-xperience","staging-sync","vendor"],"not_affected_if":["unknown"],"how_to_check":"Confirm whether the Staging Sync Server feature is in use on your Kentico Xperience instance; the sources do not give a file or setting to inspect.","fix":"Apply the mitigations per Kentico's vendor instructions, as CISA directs; the sources do not name a fixed version.\nIf mitigations are unavailable, CISA says to discontinue use of the product.","status":"open","published_at":"2025-03-24T19:15:52+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:43+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:38:43Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per Kentico's vendor instructions, as CISA directs; the sources do not name a fixed version.\nIf mitigations are unavailable, CISA says to discontinue use of the product.","reach":"network","summary":"Kentico Xperience has a path traversal flaw in its Staging Sync Server that lets an authenticated user write files to arbitrary locations relative to the server's paths. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["kentico-xperience","staging-sync"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker writes arbitrary files to server paths, possibly enabling code execution.","analyst_note":"Find Kentico's vendor advisory and the affected/fixed version range, and confirm whether the Staging Sync Server is enabled by default; the sources give no versions.","how_to_check":"Confirm whether the Staging Sync Server feature is in use on your Kentico Xperience instance; the sources do not give a file or setting to inspect.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000468,"input_tokens":2538,"output_tokens":429,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':110C '-2025':18A,21A '-2749':19A,22A '22':109C 'action':100C 'activ':68B 'allow':9A,82C 'appli':101C 'applic':107C 'arbitrari':56B,92C 'authent':2A,10A,51B,84C 'bod':108C 'cisa':64B,98C 'cloud':113C 'code':4A 'contain':75C 'could':81C 'cve':17A,20A 'data':93C 'discontinu':116C 'execut':5A 'exploit':28B,69B 'file':54B 'flaw':42B 'follow':106C 'guidanc':111C 'instruct':105C 'kentico':7A,23A,24A,26A,30B,36B,73C 'kentico-xperi':29B 'let':49B 'list':65B 'locat':57B,97C 'mitig':102C,122C 'path':40B,63B,77C,95C 'per':103C 'product':120C 'relat':58B,96C 'remot':3A 'requir':99C 'server':14A,47B,61B,89C 'servic':114C 'stage':12A,33B,45B,87C 'staging-sync':32B 'sync':13A,34B,46B,88C 'travers':41B,78C 'unavail':124C 'upload':16A,91C 'use':117C 'user':11A,52B,85C 'vendor':35B,104C 'vulner':79C 'wild':72B 'write':53B 'xperienc':8A,31B,37B,74C 'xperience':25A,27A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-24T19:15:52+00:00","kev":{"dateAdded":"2026-04-20","dueDate":"2026-05-04","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-2749","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2749","severity":null,"published_at":"2026-04-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T19:35:19+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-2749","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2749","severity":null,"published_at":"2025-03-24T19:15:52+00:00","modified_at":"2026-06-17T09:07:33+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}