CVE-2025-34510
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 18.0%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 18.04% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-23
- Affected
- sitecore/experience commerce · sitecore/experience manager · sitecore/experience platform · sitecore/managed cloud
- Source
- disclosure@vulncheck.com
References
- https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/Exploit, Third Party Advisory
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.