CVE-2019-25229 | THREATINT

Description

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling unauthorized file uploads.

PUBLISHED Reserved 2025-12-17 | Published 2025-12-18 | Updated 2025-12-18 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Unrestricted Upload of File with Dangerous Type

Product status

Any version

affected

Credits

Kentico Security Team finder

References

devnet.kentico.com/download/hotfixes (Kentico DevNet Hotfixes) vendor-advisory patch

www.vulncheck.com/...ence-mvc-forms-unrestricted-file-upload (VulnCheck Advisory: Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload) third-party-advisory

cve.org (CVE-2019-25229)

nvd.nist.gov (CVE-2019-25229)

Download JSON