An authenticated user of Kentico Xperience’s Staging Sync Server can upload arbitrary data to paths relative to the application, enabling path traversal and arbitrary file upload. Uploaded content can be executed server side, resulting in remote code execution on the host. The vulnerability is tied to CWE‑22 (Path Traversal) and CWE‑434 (Unrestricted Upload of File with Dangerous Type).

Kentico Xperience versions through 13.0.178 are affected. Any user with authentication to the CMS who can interact with the Staging Sync Server is potentially vulnerable. No specific OS or middleware is mentioned beyond the Kentico platform itself.

The CVSS score of 7.2 indicates high severity, while the EPSS score of 3% reflects a lower exploitation probability. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, underscoring active exploitation risk. Because the flaw requires authenticated access to the Staging Sync feature, the attack vector is likely an insider or compromised CMS user, though the impact remains full remote code execution on the web server.