A mailroom that files unopened boxes and later hands them to employees
Kentico Xperience's multi-file upload does not fully validate or filter uploaded files, so a crafted SVG/HTML or polyglot file can be stored and later served from the CMS origin. The affected range is all versions through 13.0.178. When a victim opens the uploaded file, script executes in their authenticated CMS session, enabling session theft, content manipulation, or privilege escalation.
Vendor severity MEDIUM (6.1) is broadly right for the mechanics: network reachable, low complexity, no privileges assumed, user interaction required, scope changed. Real-world conditions support at most MEDIUM—upload endpoints are usually behind authentication in production Kentico sites, dangerous file types are often blocked by configuration, and a victim must actively open the planted file. The high EPSS score (0.60586) is suspicious given no known exploitation or public PoC, so treat it as an outlier.
4 steps from start to impact.
Locate a reachable multi-file upload endpoint
- Network access to the Kentico web application
- Multi-file upload endpoint enabled
- If authentication is required, valid low-privilege credentials
- Most production Kentico sites restrict uploads to authenticated CMS editors
- Custom upload forms without auth are uncommon
- WAF or NGFW can block suspicious file upload requests
Upload a crafted file that survives validation
- Server accepts active-content file extensions or can be induced to store one
- No server-side filtering, MIME sniffing, or sanitization on uploaded files
- Default Kentico media library may restrict dangerous extensions
- Some deployments set Content-Disposition: attachment for unknown types
- Antivirus/file-integrity monitoring may flag HTML/SVG with scripts
Lure a victim to open the stored file
- Victim is logged into the Kentico site
- Victim clicks the link or views the file
- No Content-Security-Policy or nosniff header blocking script execution
- Phishing-resistant user awareness may reduce clicks
- If file is served with Content-Disposition: attachment, script won't run inline
- CSP can block inline and external scripts
Execute script to act as the victim
- Victim session has elevated privileges (e.g., CMS admin)
- Cookies or local storage tokens accessible to script
- No CSRF token or SameSite cookie restricting cross-site actions
- HttpOnly session cookies prevent direct token theft
- Multi-factor authentication on admin accounts limits session reuse
- Victim may have low-privilege account, limiting impact
Content-Disposition: attachment plus X-Content-Type-Options: nosniff. This breaks script execution on access. Residual severity LOW (3.0).- Client-side input validation on the upload form — server-side validation is absent, so browser-level checks are trivially bypassed.
- Weak password policies alone — the vulnerability is not credential-focused; an authenticated attacker with upload permission still triggers it.
- Network segmentation alone — if the CMS is reachable by the intended user population, it is reachable by the attacker.
The supporting signals.
| In-the-wild status | No known active exploitation; KEV not listed (as of 2025-12-27). |
|---|---|
| Proof of concept | No public PoC identified in GitHub, ExploitDB, or nuclei templates in search results; no repo named after CVE-2025-2748. |
| EPSS | 0.60586 (60.586% 30-day probability) — unusually high for stored XSS; no exploitation evidence supports it. |
| KEV status | Not listed in CISA KEV. |
| CVSS v3.1 vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 MEDIUM. Low attack complexity, no privileges, user interaction required, scope changed. |
| Affected versions | Kentico Xperience through 13.0.178 (all prior versions). |
| Fixed version | Not explicitly stated in NVD/INCIBE; patch likely in later DevNet release. |
| Disclosure date | 2025-03-24 (NVD published 2025-03-24 19:15 UTC). |
| Reported by | VulnCheck (secondary source [email protected] in NVD); MITRE CVE.org record. |
| Scanning exposure | No public Shodan/GreyNoise/FOFA data for this CVE; exposure is limited to internet-facing Kentico installations with upload endpoints enabled. |
Sources.
Why this verdict
- Role multiplier: Kentico Xperience is a CMS, not a canonical identity/hypervisor/edge/CA component; the worst plausible high-value role is a customer portal or e-commerce site where stored XSS yields site-level admin or session theft, not domain/fleet/supply-chain scale.
- Upload surface is usually authenticated: CVSS assumes PR:N, but most production Kentico sites require editor credentials for multi-file upload, cutting reachable population.
- User interaction and no active exploitation: victim must open a planted file; no KEV, no public PoC, no in-the-wild reports despite high EPSS.
- Action timeline: noisgate mitigation SLA has no mandatory window for MEDIUM; noisgate remediation SLA is ≤ 365 days for the vendor patch.
Why not higher?
Stored XSS does not provide direct unauthenticated RCE, lateral movement, or domain escalation. The attack chain stalls unless a user with an active session opens the file, and typical Kentico deployments do not expose upload endpoints to anonymous users. No known exploitation or public PoC means real-world impact is currently limited.
Why not lower?
If an authenticated admin opens the malicious file, the attacker can take over the CMS—adding admin accounts, modifying content, and exfiltrating customer data. Stored XSS persists until the file is removed, and the product is an enterprise CMS often hosting sensitive websites. The EPSS value, though likely anomalous, suggests some exploitation probability if uploads are reachable.
Crowdsourced verification payload.
Run on the Kentico Xperience web server as Administrator or with read access to the web root. From PowerShell: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2025-2748.ps1. It scans common web roots for Kentico DLLs and compares the file version to 13.0.178; outputs VULNERABLE, PATCHED, or UNKNOWN. Requires read access to IIS web directories.
# Check-CVE-2025-2748.ps1
# Detects Kentico Xperience installations and compares version to 13.0.178
$ErrorActionPreference = 'SilentlyContinue'
$roots = @('C:\inetpub\wwwroot','C:\Program Files\Kentico','D:\websites','C:\web')
$dllPattern = 'Kentico*.dll'
$files = @()
foreach ($root in $roots) {
if (Test-Path $root) {
$files += Get-ChildItem -Path $root -Recurse -Filter $dllPattern -File | Where-Object { $_.Name -match 'Kentico\.(ContentManagement|CMS|Core)' }
}
}
if ($files.Count -eq 0) {
Write-Output 'UNKNOWN'
exit 2
}
$vulnerable = $false
$patched = $false
foreach ($file in $files) {
try {
$version = $file.VersionInfo.FileVersion
if ($version) {
if ([version]$version -le [version]'13.0.178') {
Write-Output ('VULNERABLE ' + $file.FullName + ' version ' + $version)
$vulnerable = $true
} else {
Write-Output ('PATCHED ' + $file.FullName + ' version ' + $version)
$patched = $true
}
}
} catch {}
}
if ($vulnerable -and -not $patched) { Write-Output 'VULNERABLE'; exit 1 }
if ($patched -and -not $vulnerable) { Write-Output 'PATCHED'; exit 0 }
if ($vulnerable -and $patched) { Write-Output 'VULNERABLE (mixed)'; exit 1 }
Write-Output 'UNKNOWN'; exit 2