CVE-2025-32370 is a high severity (CVSS 7.2) file upload flaw in Kentico Xperience before 13.0.178. ZIP files accepted for unauthenticated upload can be used to create files with other extensions. Install hotfix 13.0.178 or later from the Kentico DevNet downloads.
What's affected
The NVD record says Kentico Xperience before 13.0.178 has a defined set of allowed ContentUploader file extensions for unauthenticated uploads. Because .zip is processed through TryZipProviderSafe, extra functionality can create files with other extensions. The record adds that this is a separate issue, not necessarily related to SVG or XSS.
The weakness classes are CWE-434 (unrestricted upload of a file with a dangerous type) and CWE-912 (hidden functionality). The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L. It is reachable over the network with no login, and the scope is changed, meaning the impact can extend past the component itself.
Kentico publishes hotfixes on its DevNet site, and its security table lists fixed dates by hotfix number. The record's own cut off is 13.0.178, so that is the first version to run. Confirm the exact hotfix on the DevNet page for your product line.
How to check if you're exposed
Check the version in the administration interface, or from the build files in your deployment folder. Anything below 13.0.178 on the 13 line is in scope per the record.
find . -name "CMS.Base.dll"
Then read the file version property of that assembly with your usual tool. Also confirm whether the ContentUploader feature is reachable from the internet on your site, and review the upload folders for files whose type does not match what editors normally add.
If you run Kentico behind a content delivery layer, check whether it blocks unauthenticated posts to the upload handler.
What to do now
- Update to Kentico Xperience 13.0.178 or later, using the latest hotfix from the DevNet download area.
- Review the temporary and upload folders for files with unexpected extensions, and remove any that nobody can explain.
- Restrict unauthenticated uploads at the web server or WAF if your site does not need them.
- Make sure uploaded content is never executed from the folder it lands in.
- Subscribe to the Kentico hotfix list.
The free in-browser dependency scan takes a manifest or lockfile and lists known CVEs for the packages in it, and the Gold directory lets you look up a CVE by id.
Why it matters
Upload handlers need two rules: only accept the types you intend, and treat what arrives as untrusted after it is saved. Archive formats make the first rule hard, since a ZIP is a container that can hold anything, and some code paths unpack it for you.
Here, an allow list of extensions exists, but the ZIP path gives a second route to create files of other types. The lesson is to apply the same checks after unpacking as before. A researcher write up on a related Kentico issue, CVE-2025-2748, discusses the same storage provider code path, so teams reviewing this fix should read it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
The record says before 13.0.178 is affected. Install that hotfix or later, and check the DevNet hotfix page for your line.
Is it exploited in the wild?
The record's KEV flag is false and nothing reviewed reports attacks.
Sources
- Gold entry for CVE-2025-32370
- Kentico hotfix downloads and security table
- watchTowr Labs write up of a related Kentico issue
Last reviewed: 19 October 2026.
