---
title: "Kentico CVE-2025-2749: Staging Upload Path Traversal to RCE"
url: https://erroneo.us/security/briefs/kentico-xperience-cve-2025-2749-staging-path-traversal/
description: "A post-auth path traversal in Kentico Xperience 13 staging lets a staging caller write files such as web shells. Fixed in 13.0.178; added to KEV in April 2026."
type: security-brief
section: "Security Digest"
date_published: 2025-03-06
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-2749"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Kentico CVE-2025-2749: Staging Upload Path Traversal to RCE

**Verdict: Check exposure.** This is the file-write half of the 2025 Kentico staging chain; the March 2025 hotfix closes it, so confirm every instance is on a current hotfix and hunt for planted files only where staging was enabled on an old build.

- **Who must act:** Operators of Kentico Xperience 13 at hotfix 13.0.177 or lower (13.0.178 or lower per the CVE record) with the Staging Service enabled, especially if it was reachable from the internet.
- **Who can relax:** Sites on a current hotfix, and sites that never enabled content staging or that block SyncServer.asmx to everyone but their own staging servers.
- **Affected:** Kentico Xperience 13.0.177 and lower (Kentico); Kentico Xperience through 13.0.178 (CVE record); Only instances with the Staging Service enabled
- **Fixed:** Hotfix 13.0.178 (Mar 6, 2025); Latest cumulative hotfix recommended: 13.0.218 (Oct 22, 2026)
- **CVEs:** CVE-2025-2749
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the hotfix version of every Kentico Xperience 13 instance, including staging source servers.
2. Apply the latest cumulative hotfix, which also covers the staging auth bypasses CVE-2025-2746 and CVE-2025-2747; read the staging notes for 13.0.178 and 13.0.180 first.
3. If you do not use staging, deny all access to Staging/SyncServer.asmx in /CMS/CMSPages/Web.config.
4. If you use staging, use X.509 authentication and allow SyncServer.asmx only from your source servers.
5. Rotate the staging service credentials and remove staging accounts nobody uses.

### How to check if you are affected

- Search IIS logs for POST requests to /CMSPages/Staging/SyncServer.asmx from addresses that are not your staging source servers.
- List .aspx, .ashx and other script files under the web root modified after deployment, especially outside media library folders.
- Review media libraries and the Kentico event log for media files or staging tasks nobody on your team created.
- Look for w3wp.exe spawning cmd.exe or powershell.exe on the web server.

## What happened

Kentico Xperience 13's Staging Service, `/CMSPages/Staging/SyncServer.asmx`, lets one instance push content and objects to another. In January 2025, Piotr Bazydło of watchTowr found two authentication bypasses in it, CVE-2025-2746 and CVE-2025-2747, which our earlier brief covers. He also found a second bug that turns staging access into code execution. That bug is CVE-2025-2749.

When the Staging Service imports a media file, it builds the target path from values in the staged object. Per [watchTowr's write-up](https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/), one of those values "isn't verified against path traversal sequences." A caller with staging access can therefore write a file outside the media library, including an ASPX page in the web root that the server will execute. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-2749) describes it as path traversal and arbitrary file upload "leading to remote code execution." VulnCheck, the CNA, scores it CVSS 3.1 7.2, because it requires high privileges. Its [advisory](https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce) gives CVSS 4.0 8.6.

watchTowr reported the bug on January 28, 2025. Kentico fixed it in hotfix 13.0.178 on March 6. Its [hotfix list](https://devnet.kentico.com/download/hotfixes) calls it "Post-auth remote code execution," found in 13.0.177 and lower. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749) on April 20, 2026, six months after the two bypasses, with a May 4 deadline. Neither [The Hacker News](https://thehackernews.com/2026/04/cisa-adds-8-exploited-flaws-to-kev-sets.html) nor [SecurityWeek](https://www.securityweek.com/organizations-warned-of-exploited-cisco-kentico-zimbra-vulnerabilities/) found public details of the attacks. Nobody has named attackers as of Oct 23, 2026.

## Who is affected

Kentico Xperience 13 below hotfix 13.0.178 with staging enabled. The [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-2749) entry and CVE record say "through 13.0.178." Kentico says 13.0.178 fixes it. Staging is off by default.

## Do you really need to act?

On its own this bug needs staging credentials, so it can look minor. In practice the two bypasses supplied that access on the same old builds, which turns the pair into pre-auth code execution. The KEV listing suggests someone used this step. The fix is 19 months old, so this is a check: confirm the hotfix level everywhere and hunt only where staging was enabled on an old build.

## What to do now

1. Check each instance's hotfix version and apply the latest, 13.0.218 as of October 22, 2026. Read the staging notes for 13.0.178 and 13.0.180 first.
2. If you do not use staging, set `<deny users="*" />` for `Staging/SyncServer.asmx` in `/CMS/CMSPages/Web.config`.
3. If you do, use X.509 authentication and allow the endpoint only from your source servers.
4. Rotate staging credentials and remove unused staging accounts.

## How to tell if you were hit

Search IIS logs for POSTs to `SyncServer.asmx` from hosts that are not your staging servers. List recently changed script files, for example `Get-ChildItem C:\inetpub\wwwroot -Recurse -Include *.aspx,*.ashx | Sort-Object LastWriteTime -Descending`, and investigate any nobody deployed. Check media libraries and the event log for unexplained staging tasks, and look for `w3wp.exe` spawning shells. If you find any of these, rebuild the server and rotate its database credentials.

## Timeline

- Jan 28, 2025 — watchTowr reports the bug to Kentico.
- Mar 6, 2025 — Hotfix 13.0.178 fixes it.
- Mar 17, 2025 — watchTowr publishes its research.
- Mar 24, 2025 — CVE-2025-2749 is published.
- Apr 20, 2026 — CISA adds it to KEV (due May 4).

## Sources

1. [Kentico — Kentico Xperience 13 hotfixes and security bugs](https://devnet.kentico.com/download/hotfixes)
2. [watchTowr Labs — Bypassing Authentication Like It's The '90s: Pre-Auth RCE Chain(s) in Kentico Xperience CMS](https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/)
3. [CVE record — CVE-2025-2749](https://www.cve.org/CVERecord?id=CVE-2025-2749)
4. [NVD — CVE-2025-2749](https://nvd.nist.gov/vuln/detail/CVE-2025-2749)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-2749](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2749)
6. [VulnCheck — Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE](https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce)
7. [The Hacker News — CISA Adds 8 Exploited Flaws to KEV (April 2026)](https://thehackernews.com/2026/04/cisa-adds-8-exploited-flaws-to-kev-sets.html)
8. [SecurityWeek — Organizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities](https://www.securityweek.com/organizations-warned-of-exploited-cisco-kentico-zimbra-vulnerabilities/)

---
Source page: https://erroneo.us/security/briefs/kentico-xperience-cve-2025-2749-staging-path-traversal/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt