CVE-2019-25229
Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 18, 2025
- Updated
- Dec 18, 2025
- Reserved
- Dec 17, 2025
Description
An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling unauthorized file uploads.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
XperienceKentico |
|
References
- Kentico DevNet Hotfixesvendor-advisorypatch
- VulnCheck Advisory: Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.