CVE-2019-25229 HIGH

CVE-2019-25229: Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload

Vendor Kentico

Product Xperience

Weakness CWE-434 · Unrestricted file upload

Published December 18, 2025

Last update December 18, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling unauthorized file uploads.

Key dates

02Disclosure timeline

December 18, 2025 CVE published

December 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25229 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-32028 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution CVE-2025-12673 Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload CVE-2023-6925 Unlimited Addons for WPBakery Page Builder <= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload CVE-2023-48777 WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability CVE-2023-48275 WordPress Widgets for Google Reviews plugin <= 11.0.2 - Arbitrary File Upload vulnerability