CVE-2025-34139

Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read

State: Published
Severity: 8.7 High
Published: Jul 25, 2025
Updated: Nov 19, 2025
Reserved: Apr 15, 2025

Description

A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-522 Insufficiently Protected Credentials
CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
Experience Manager (XM)Sitecore	8.0 Initial Release through 10.4 Initial Release and laterAffected
Experience Platform (XP)Sitecore	8.0 Initial Release through 10.4 Initial Release and laterAffected
Experience Commerce (XC)Sitecore	8.0 Initial Release through 10.4 Initial Release and laterAffected
Managed CloudSitecore	8.0 Initial Release through 10.4 Initial Release and laterAffected

References

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003650vendor-advisorypatch
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003661vendor-advisorypatch
https://www.vulncheck.com/advisories/sitecore-xm-xp-xc-managed-cloud-arbitrary-file-readthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.