Path Traversal and Arbitrary File Upload RCE in Kentico Xperience Staging Sync Server

Successful exploitation allows an authenticated attacker to perform arbitrary file upload via path traversal and write attacker-controlled content to unintended locations on the server. This can lead to server-side code execution if executable content is placed in a location processed by the application or web server. Depending on deployment specifics, impact can include full compromise of the Kentico application, unauthorized modification of application files, persistence, and potential follow-on access to underlying server resources.

If immediate patching is not possible, restrict or disable Staging Sync Server access where operationally feasible, limit the feature to trusted administrative users only, and reduce network exposure of the management interface. Harden file-system permissions so the application cannot write to executable or web-served directories unnecessarily. Monitor for suspicious file creation, unexpected changes under the web root, and anomalous staging activity. Web server controls that prevent execution from upload directories may reduce RCE risk but do not eliminate the underlying arbitrary write condition.

Upgrade Kentico Xperience to a fixed version later than 13.0.178, per vendor guidance. Apply the vendor patch or updated release that corrects the Staging Sync Server path handling and prevents traversal outside intended upload directories. After patching, review the server for unauthorized files written through the vulnerable upload path, especially web shells or other executable payloads in web-accessible directories.