{"id":"CVE-2025-32370","aliases":["EUVD-2025-9930","GHSA-vc28-9jgm-3qpx"],"status":"published","title":"Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions...","description":"Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01596,"percentile":0.75944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434","CWE-912"],"published":"2025-04-06T00:00:00Z","modified":"2026-06-17T09:11:53Z","exploits":[{"source":"exploitdb","id":"EDB-52290","title":"Kentico Xperience 13.0.178 - Cross Site Scripting (XSS)","type":"webapps","platform":"multiple","date":"2025-05-13","url":"https://www.exploit-db.com/exploits/52290"}],"products":[{"vendor":"kentico","product":"xperience"}],"references":[{"url":"https://devnet.kentico.com/download/hotfixes","tags":["Release Notes"]},{"url":"https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/","tags":["exploit","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32370"},{"url":"https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748"},{"url":"https://github.com/advisories/GHSA-vc28-9jgm-3qpx"}],"sources":{"cve":[{"id":"CVE-2025-32370","description":"Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.","status":"published","published":"2025-04-06T00:00:00Z","modified":"2025-04-07T14:10:46.825Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-912"],"updated_at":"2026-11-02T14:32:46.109993Z"}],"euvd":[{"id":"EUVD-2025-9930","description":"Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.","status":"published","published":"2025-04-06T00:00:00Z","modified":"2025-04-07T14:10:46Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:41.59184Z"}],"ghsa":[{"id":"GHSA-vc28-9jgm-3qpx","title":"Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions...","description":"Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.","status":"published","published":"2025-04-06T09:30:24Z","modified":"2025-04-08T21:32:38Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"high"}],"cwes":["CWE-434","CWE-912"],"updated_at":"2026-11-02T15:00:52.300715Z"}],"nvd":[{"id":"CVE-2025-32370","description":"Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.","status":"published","published":"2025-04-06T07:15:40.97Z","modified":"2026-06-17T09:11:53.423Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-912","CWE-434"],"updated_at":"2026-11-02T14:10:59.48027Z"}]}}