CVE-2025-32370: XSS
Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32370?
The severity of CVE-2025-32370 is considered moderate due to its ability to allow unauthenticated users to upload files with potentially malicious extensions.
How do I fix CVE-2025-32370?
To fix CVE-2025-32370, update your Kentico Xperience installation to version 13.0.178 or later to disable the flawed file upload functionality.
What versions of Kentico Xperience are affected by CVE-2025-32370?
CVE-2025-32370 affects all versions of Kentico Xperience prior to 13.0.178.
Can CVE-2025-32370 lead to remote code execution?
Yes, CVE-2025-32370 can potentially lead to remote code execution if an attacker exploits the unauthenticated file upload functionality.
What types of files can be uploaded due to CVE-2025-32370?
Due to CVE-2025-32370, attackers can upload .zip files which can then be processed to create files with other executable extensions.