high Known exploitedREV. 01
CVE-2025-2749Kentico Xperience — staging upload escapes into code execution
Kentico Xperience through 13.0.178 lets an account with staging sync rights upload files to paths of its own choosing, including places where the server will execute them — turning a content sync feature into remote code execution.
Read the risk
THE VITAL STATS- CVSS score
- 7.2/ 10 CVSS v3.1
- EPSS probability
- 4% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Known exploited
- Yes — CISA KEV
- CVE published
- 2025-03-24
- Added to KEV
- 2026-04-20
- Exploit published
- Yes
- Confidence
- high
- Kill chain
- initial access
- MITRE ATT&CK
- T1190, T1505.003
- Severity
- high
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attacker needsAn account with Staging Sync Server rights on the Kentico instance.
Behind the card
5 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Vendor advisorydevnet.kentico.comdevnet.kentico.com
- 04Exploitlabs.watchtowr.comlabs.watchtowr.com
- 05Writeupvulncheck.comvulncheck.com
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, exploitation.exploit_available, references, published_at | nvd.nist.gov | 2026-09-24 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added | cisa.gov | 2026-09-24 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-09-24 | scrty-crds-pipeline/0.1 | high |
| title, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-09-24 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
First printing. This card has not been reprinted since publication.