[KEV] CVE-2025-2749 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2025-2749 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2025-2749 is a path traversal vulnerability in Kentico Xperience, specifically within the Staging Sync Server component, that allows an authenticated attacker to write arbitrary data to unintended file system locations.

Technical Detail

The flaw exists in how the Staging Sync Server processes file paths during synchronization operations, failing to properly sanitize or restrict path inputs to an expected base directory. An authenticated user can supply crafted path values that resolve to locations outside the intended directory, enabling arbitrary file writes at relative path destinations on the server. Depending on the target path and server configuration, this could be leveraged to overwrite sensitive files, plant web shells, or achieve remote code execution.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this vulnerability to the Known Exploited Vulnerabilities catalog on April 20, 2026. The exploit maturity is rated Operational, meaning functional exploit code capable of reliable exploitation exists and is being used in real-world attacks, not merely as a proof of concept.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. Given the active exploitation status and the nature of the vulnerability affecting a web content management platform, opportunistic actors targeting internet-facing CMS infrastructure are the most likely source, but no named group or campaign has been formally attributed.

What To Do

Per CISA's Known Exploited Vulnerabilities catalog, organizations subject to BOD 22-01 must apply vendor-supplied patches or implement mitigations by the deadline associated with the April 20, 2026 KEV listing. Administrators should apply the latest available Kentico Xperience security update immediately and prioritize any instance with the Staging Sync Server feature enabled and accessible over a network. If patching cannot be completed immediately, consider disabling or restricting access to the Staging Sync Server endpoint at the network perimeter. Review server file system integrity for unexpected files, particularly in web-accessible directories, as a detection measure for prior compromise.