CVE-2025-2749 is a path traversal and arbitrary file upload vulnerability in the Staging Sync Server of Kentico Xperience that lets an authenticated attacker upload arbitrary data to path-relative locations, including server-executable content, leading to remote code execution; it was disclosed by watchTowr as part of a pre-auth RCE exploit chain and is listed in the CISA KEV catalog.
Vulnerability summary
7.2
High
4.0%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-03-24
Published
Vulnerability ID: CVE-2025-2749 · Source: VulnCheck (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Kentico Xperience | cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:* | through 13.0.178 (per VulnCheck analysis); NVD's CPE applicability statement lists versions up to and including 13.0.178 as vulnerable |
What this means
CVE-2025-2749 is a path traversal (CWE-22) and unrestricted file upload (CWE-434) vulnerability in the Staging Sync Server of Kentico Xperience. NVD's description states: "An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution" (NVD).
NVD lists only a Secondary CVSS v3.1 score from source [email protected]: base score 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. NVD's status is "Analyzed," but no NVD Primary CVSS metric has been published, so this score is labelled not NVD-confirmed on this page (NVD).
VulnCheck's own advisory, published alongside the disclosure, rates the issue CVSS v4.0 8.6 (high), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, and states the affected range is Xperience builds up to and including 13.0.178 (VulnCheck).
watchTowr Labs researcher Piotr Bazydlo, who reported the flaw, documented it as one link in a broader authentication-bypass-to-RCE exploit chain against Kentico Xperience, showing how an attacker could reach the normally-authenticated Staging Sync Server endpoint without valid credentials by first bypassing the CMS's authentication checks (watchTowr Labs).
CISA added CVE-2025-2749 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-20, with a required-action due date of 2026-05-04; the catalog records known ransomware-campaign use as "Unknown." Catalog version 2026.10.29, 1,764 entries, confirmed live this run by matching the exact cveID string in the raw feed (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.04021 (90.565th percentile) (FIRST EPSS).
Because the authentication-bypass chain documented by watchTowr removes the practical requirement for valid credentials, any internet-reachable Kentico Xperience instance on an affected build should be treated as exposed to unauthenticated compromise and patched or isolated immediately, with the Staging Sync Server disabled if it is not required.
Evidence
- Authenticated path traversal and unrestricted file upload in the Staging Sync Server of Kentico Xperience, allowing server-executable content to be written and leading to RCE. — NVD
- NVD lists only a Secondary CVSS v3.1 score of 7.2 (high) from source [email protected], vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published, so the score is not NVD-confirmed. — NVD
- VulnCheck separately scores the issue CVSS v4.0 8.6 and states the affected range is Xperience builds up to and including 13.0.178. — VulnCheck
- watchTowr Labs documented the flaw as part of a pre-auth RCE exploit chain, bypassing CMS authentication before reaching the Staging Sync Server endpoint. — watchTowr Labs
- Added to the CISA KEV catalog on 2026-04-20, required-action due date 2026-05-04, known ransomware campaign use recorded as Unknown. Catalog version 2026.10.29, 1,764 entries, confirmed live this run. — CISA KEV
- EPSS score is 0.04021 (90.565th percentile) as of 2026-10-30. — FIRST EPSS
