CVE-2025-34510

Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

State: Published
Severity: 8.8 High
Published: Jun 17, 2025
Updated: Feb 26, 2026
Reserved: Apr 15, 2025

Description

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-23 Relative Path Traversal

Affected Products

Product	Versions
Experience ManagerSitecore	9.0 through 9.3Affected 10.0 through 10.4Affected
Experience PlatformSitecore	9.0 through 9.3Affected 10.0 through 10.4Affected
Experience CommerceSitecore	9.0 through 9.3Affected 10.0 through 10.4Affected

References

https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/third-party-advisoryexploittechnical-description
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.