Kentico CVE-2025-2749: Staging Upload Path Traversal to RCE

What to do

1. Check the hotfix version of every Kentico Xperience 13 instance, including staging source servers.
2. Apply the latest cumulative hotfix, which also covers the staging auth bypasses CVE-2025-2746 and CVE-2025-2747; read the staging notes for 13.0.178 and 13.0.180 first.
3. If you do not use staging, deny all access to Staging/SyncServer.asmx in /CMS/CMSPages/Web.config.
4. If you use staging, use X.509 authentication and allow SyncServer.asmx only from your source servers.
5. Rotate the staging service credentials and remove staging accounts nobody uses.

How to check if you are affected or compromised

• Search IIS logs for POST requests to /CMSPages/Staging/SyncServer.asmx from addresses that are not your staging source servers.
• List .aspx, .ashx and other script files under the web root modified after deployment, especially outside media library folders.
• Review media libraries and the Kentico event log for media files or staging tasks nobody on your team created.
• Look for w3wp.exe spawning cmd.exe or powershell.exe on the web server.

What happened#

Kentico Xperience 13's Staging Service, /CMSPages/Staging/SyncServer.asmx, lets one instance push content and objects to another. In January 2025, Piotr Bazydło of watchTowr found two authentication bypasses in it, CVE-2025-2746 and CVE-2025-2747, which our earlier brief covers. He also found a second bug that turns staging access into code execution. That bug is CVE-2025-2749.

When the Staging Service imports a media file, it builds the target path from values in the staged object. Per watchTowr's write-up, one of those values "isn't verified against path traversal sequences." A caller with staging access can therefore write a file outside the media library, including an ASPX page in the web root that the server will execute. The CVE record describes it as path traversal and arbitrary file upload "leading to remote code execution." VulnCheck, the CNA, scores it CVSS 3.1 7.2, because it requires high privileges. Its advisory gives CVSS 4.0 8.6.

watchTowr reported the bug on January 28, 2025. Kentico fixed it in hotfix 13.0.178 on March 6. Its hotfix list calls it "Post-auth remote code execution," found in 13.0.177 and lower. CISA added it to KEV on April 20, 2026, six months after the two bypasses, with a May 4 deadline. Neither The Hacker News nor SecurityWeek found public details of the attacks. Nobody has named attackers as of Oct 23, 2026.

Who is affected#

Kentico Xperience 13 below hotfix 13.0.178 with staging enabled. The NVD entry and CVE record say "through 13.0.178." Kentico says 13.0.178 fixes it. Staging is off by default.

Do you really need to act?#

On its own this bug needs staging credentials, so it can look minor. In practice the two bypasses supplied that access on the same old builds, which turns the pair into pre-auth code execution. The KEV listing suggests someone used this step. The fix is 19 months old, so this is a check: confirm the hotfix level everywhere and hunt only where staging was enabled on an old build.

What to do now#

1. Check each instance's hotfix version and apply the latest, 13.0.218 as of October 22, 2026. Read the staging notes for 13.0.178 and 13.0.180 first.
2. If you do not use staging, set <deny users="*" /> for Staging/SyncServer.asmx in /CMS/CMSPages/Web.config.
3. If you do, use X.509 authentication and allow the endpoint only from your source servers.
4. Rotate staging credentials and remove unused staging accounts.

How to tell if you were hit#

Search IIS logs for POSTs to SyncServer.asmx from hosts that are not your staging servers. List recently changed script files, for example Get-ChildItem C:\inetpub\wwwroot -Recurse -Include *.aspx,*.ashx | Sort-Object LastWriteTime -Descending, and investigate any nobody deployed. Check media libraries and the event log for unexplained staging tasks, and look for w3wp.exe spawning shells. If you find any of these, rebuild the server and rotate its database credentials.

Timeline#

• Jan 28, 2025 — watchTowr reports the bug to Kentico.
• Mar 6, 2025 — Hotfix 13.0.178 fixes it.
• Mar 17, 2025 — watchTowr publishes its research.
• Mar 24, 2025 — CVE-2025-2749 is published.
• Apr 20, 2026 — CISA adds it to KEV (due May 4).

Vulnerability records

• CVE-2025-2749 · KEV 2026-04-20 · An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Kentico — Kentico Xperience 13 hotfixes and security bugs devnet.kentico.com
2. watchTowr Labs — Bypassing Authentication Like It's The '90s: Pre-Auth RCE Chain(s) in Kentico Xperience CMS labs.watchtowr.com
3. CVE record — CVE-2025-2749 cve.org
4. NVD — CVE-2025-2749 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2025-2749 cisa.gov
6. VulnCheck — Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE vulncheck.com

Coverage and analysis

1. The Hacker News — CISA Adds 8 Exploited Flaws to KEV (April 2026) thehackernews.com
2. SecurityWeek — Organizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities securityweek.com