CVE-2025-2749 in kentico xperience
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
Affected software: kentico xperience
Scores
- CVSS: 7.2 (high)
- EPSS: 4.02% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-04-20
- Published: 2025-03-24
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Apply Kentico Xperience hotfix for Staging Sync Server auth bypass and path traversal (CVE-2025-2746, CVE-2025-2747, CVE-2025-2749)
Patch or upgrade. Kentico Xperience's Staging Sync Server lets attackers bypass its username/password authentication and then write files outside its folder, leading to code execution. Applying hotfix 13.0.178 or later, and turning off or restricting the staging service, closes it.
Applies to: Kentico Xperience 13 up to 13.0.172 (CVE-2025-2746) and up to 13.0.177 (CVE-2025-2747), and Kentico 12 and older, when the Staging service is on with user name and password authentication.
- In the Kentico administration, open System and note the version and hotfix level (for example 13.0.172).
- Download the latest Kentico Xperience 13 hotfix from Kentico DevNet (https://devnet.kentico.com/download/hotfixes) and install it with the Hotfix utility. Use at least 13.0.178: 13.0.173 fixes CVE-2025-2746, and 13.0.178 fixes the second bypass, CVE-2025-2747.
- Kentico 12 and older get no hotfix for these CVEs: upgrade to Xperience 13 with the latest hotfix, or apply the next steps.
- If you do not use content staging, turn off the Staging service (Settings > Versioning & Synchronization > Staging) and block /CMSPages/Staging/SyncServer.asmx at IIS or the reverse proxy.
- If you do use staging, switch the staging authentication from user name and password to X.509, which these bypasses do not affect, and allow SyncServer.asmx only from your source servers.
- Check the web root for .aspx and other files you did not deploy, and review the Kentico event log for staging tasks you did not start.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.