CVE-2025-32370
📋 TL;DR
Kentico Xperience CMS versions before 13.0.178 allow unauthenticated attackers to bypass file extension restrictions by uploading .zip files that get processed by TryZipProviderSafe, enabling them to create files with arbitrary extensions. This vulnerability affects all Kentico Xperience installations with the vulnerable version exposed to untrusted users. Attackers can potentially achieve remote code execution by uploading malicious files.
💻 Affected Systems
- Kentico Xperience CMS
📦 What is this software?
Xperience by Kentico
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
File upload leading to web shell deployment, allowing attackers to execute arbitrary commands on the server.
If Mitigated
Limited impact with proper file validation and restricted upload permissions in place.
🎯 Exploit Status
Public technical analysis available showing exploitation path from file upload to RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.0.178 or later
Vendor Advisory: https://devnet.kentico.com/download/hotfixes
Restart Required: Yes
Instructions:
1. Download hotfix from Kentico DevNet. 2. Apply patch to affected Kentico Xperience installation. 3. Restart application/services. 4. Verify version is 13.0.178 or higher.
🔧 Temporary Workarounds
Disable unauthenticated file uploads
allRestrict ContentUploader functionality to authenticated users only.
Block .zip uploads
allConfigure web application firewall or server rules to block .zip file uploads to vulnerable endpoints.
🧯 If You Can't Patch
- Implement strict file upload validation rejecting all .zip files.
- Isolate Kentico instance behind reverse proxy with strict content filtering.
🔍 How to Verify
Check if Vulnerable:
Check Kentico Xperience version in administration panel or web.config file.Check Version:
Check Administration -> System -> About in Kentico interfaceVerify Fix Applied:
Confirm version is 13.0.178 or higher and test file upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual .zip file uploads from unauthenticated sources
- Files with unexpected extensions being created
Network Indicators:
- POST requests with .zip files to upload endpoints
- Subsequent requests to newly created files
SIEM Query:
source="web_server" AND (uri_path="*upload*" AND file_extension="zip")