Katalog CVE
CVSS 7.2 · High
KEV · sudah dieksploitasi
EPSS 4,0%
Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada kentico xperience. Skor CVSS 3.1 7.2 (High) menurut vulncheck.com. Masuk katalog KEV CISA pada 20 April 2026, artinya sudah terbukti dieksploitasi.
Deskripsi (NVD)
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
Rincian
- Terbit di NVD
- 24 Maret 2025
- Terakhir diubah
- 17 Juni 2026
- Status NVD
- Analyzed
- CVSS 3.1
- 7.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator
- Jenis kelemahan (CWE)
-
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type
- EPSS (30 hari)
- 4,0% peluang dieksploitasi; lebih tinggi dari 90,3% CVE lain
Known Exploited Vulnerabilities (CISA)
- Nama
- Kentico Xperience Path Traversal Vulnerability
- Masuk KEV
- 20 April 2026
- Tenggat CISA
- 4 Mei 2026 (untuk instansi federal AS)
- Ransomware
- Belum tercatat
- Tindakan wajib
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Produk dan versi terdampak
| Vendor | Produk | Versi terdampak |
|---|
| kentico |
xperience |
Semua versi hingga 13.0.178 |
> Data dari konfigurasi CPE di NVD.
Referensi dan perbaikan
Sumber:
NVD ·
CVE.org
·
KEV CISA
·
EPSS.
Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA.
Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat
kanal pelaporan.