CVE-2025-2748

What it actually does

Kentico Xperience through version 13.0.178 does not sufficiently validate or sanitize files submitted through its multiple-file upload functionality. An attacker who can upload a crafted file can cause attacker-controlled script content to be stored by the application and later executed in the browser of a user who views or interacts with the uploaded content. Because this is stored cross-site scripting, the payload can persist until the malicious file or associated content is removed, potentially allowing session theft, actions performed in the victim’s browser context, phishing overlays, content manipulation, or administrative workflow abuse depending on the privileges of the viewing user.

Why it matters to the business

Successful exploitation can compromise users who access affected uploaded content, including privileged content editors or administrators. This may lead to unauthorized CMS changes, account takeover, reputational damage from defaced or malicious pages, and potential exposure of sensitive content managed in Kentico Xperience. The issue is not currently listed in CISA KEV and is not flagged for ransomware use, but the EPSS score is elevated and exploit maturity is weaponized, so internet-facing or contributor-accessible Kentico deployments should be treated as high priority for remediation.

How an attack unfolds

An attacker first obtains access to a feature, workflow, or account role that permits uploading multiple files in Kentico Xperience, or abuses any public-facing upload path that reaches that functionality. They then prepare a file whose name, metadata, MIME type, extension handling, or embedded content contains script or HTML that bypasses the application’s incomplete filtering. After upload, the malicious content is stored by the application. When another user later views the uploaded file, listing, preview, media library entry, or page that renders the file details, the browser executes the attacker’s script in the context of the Kentico Xperience site. If the victim is an administrator or editor, the attacker may use the script to steal session-related data where accessible, perform unauthorized CMS actions via the victim’s authenticated session, alter content, create persistence through malicious content entries, or redirect users to credential-harvesting pages.

How to fix it

Upgrade Kentico Xperience to a version newer than 13.0.178 that contains the vendor fix. If immediate upgrade is not possible, restrict access to multiple-file upload functionality to trusted authenticated users only, disable public or anonymous uploads, enforce strict allowlists for file extensions and MIME types, store uploaded files on a non-executable/static-file domain where possible, prevent uploaded SVG/HTML/XML/script-capable content from being rendered inline, and apply output encoding wherever file names, metadata, previews, or upload results are displayed. Review and remove suspicious uploaded files and metadata after patching, because stored payloads may remain even after the code-level flaw is fixed.

How to confirm the fix worked

Confirm that all Kentico Xperience deployments are upgraded beyond 13.0.178. Review application package/version information, vendor hotfix level, deployment manifests, and administrative system information pages where available. Test the multiple-file upload workflow in a non-production environment with benign XSS test strings in file names, metadata, and supported upload formats, and verify that the content is rejected, neutralized, downloaded as an attachment, or safely encoded rather than executed. Validate that public upload endpoints require appropriate authentication and authorization, that dangerous extensions such as .html, .svg, .xml, .js, and mixed-case variants are blocked or safely handled, and that historical uploaded files do not contain active script content.

Typical attack path

1. Identify a Kentico Xperience instance running version 13.0.178 or earlier with accessible multiple-file upload functionality.
2. Obtain upload capability through a public form, contributor account, compromised user account, or social-engineered workflow.
3. Craft a file or file metadata containing a stored XSS payload that bypasses upload validation and filtering.
4. Upload the malicious file through the multiple-file upload feature.
5. Wait for an authenticated user, editor, or administrator to view the uploaded item, preview, media listing, or rendered page.
6. Execute JavaScript in the victim’s browser under the trusted Kentico Xperience site origin.
7. Use the victim’s browser session to perform unauthorized actions, modify CMS content, phish credentials, redirect users, or establish additional stored malicious content.

How to detect it

Investigate whether suspicious files were uploaded through Kentico Xperience multiple-file upload features and whether those files were later viewed by privileged users. Useful sources include web server access logs, reverse proxy/WAF logs, Kentico application logs, CMS audit logs, media library or content change history, authentication/session logs, and endpoint or file-integrity telemetry for uploaded content directories. Look for upload requests containing script-like strings, encoded JavaScript, event-handler attributes, suspicious SVG/HTML/XML uploads, mismatched MIME types, or file names containing markup. Correlate upload timestamps with subsequent administrative page views, unexpected content edits, new users or roles, configuration changes, redirects, template modifications, or unusual outbound browser requests. If known threat actor context is not available, prioritize behavioral evidence: stored malicious payloads in media/content repositories, privileged user sessions performing abnormal CMS actions soon after viewing uploaded content, and repeated upload attempts with XSS test payloads.

• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• onerror=
• onload=
• onclick=
• alert(document.domain)
• alert(1)
• prompt(1)
• confirm(1)
• <svg
• %3Csvg
• <iframe
• %3Ciframe
• document.cookie
• localStorage
• sessionStorage
• fetch(
• XMLHttpRequest
• eval(
• /CMSPages/
• /CMSModules/
• /getmedia/
• /media/
• /CMSPages/GetResource.ashx
• .svg
• .html
• .htm
• .xml
• .js

What your security team should do

• Prioritize upgrade of Kentico Xperience instances running 13.0.178 or earlier, especially internet-facing sites or sites allowing uploads from non-administrative users.
• Inventory all Kentico Xperience deployments and identify any use of multiple-file upload functionality, public forms, media libraries, or contributor upload workflows.
• Temporarily restrict or disable untrusted upload capabilities until patched and validated.
• Search uploaded content repositories and CMS-managed media for script-bearing files, suspicious metadata, and recently uploaded HTML/SVG/XML content.
• Hunt web and application logs for suspicious upload activity followed by administrator access to the uploaded item or unusual CMS changes.
• Rotate or invalidate sessions for privileged users if exploitation is suspected.
• Harden upload handling with extension and MIME allowlists, content-disposition attachment behavior, output encoding, and content security policy controls.
• Add SIEM detections for common XSS payload strings in upload requests and suspicious file types uploaded through Kentico endpoints.