Home

Description

A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.

PUBLISHED Reserved 2025-04-15 | Published 2025-07-25 | Updated 2025-11-19 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-522 Insufficiently Protected Credentials

Product status

Default status
unaffected

8.0 Initial Release (custom)
affected

Default status
unaffected

8.0 Initial Release (custom)
affected

Default status
unaffected

8.0 Initial Release (custom)
affected

Default status
unaffected

8.0 Initial Release (custom)
affected

Credits

Sitecore finder

References

support.sitecore.com/...ticle_view&sysparm_article=KB1003650 vendor-advisory patch

support.sitecore.com/...ticle_view&sysparm_article=KB1003661 vendor-advisory patch

www.vulncheck.com/...xp-xc-managed-cloud-arbitrary-file-read third-party-advisory

cve.org (CVE-2025-34139)

nvd.nist.gov (CVE-2025-34139)

Download JSON