Kentico Xperience is affected by an unrestricted file upload vulnerability that permits authenticated users to execute unauthorized file operations, posing a significant risk of system compromise.

This vulnerability is an unrestricted file upload flaw (CWE-434) residing in the MVC form file uploader components, which can be triggered by any authenticated user possessing "Read data" permissions.

The ability to upload arbitrary file types allows an attacker to bypass security controls and potentially deploy web shells or other malicious scripts. With a CVSS score of 8.8, the vulnerability indicates a high risk of total system compromise, which could lead to unauthorized data access, service disruption, and severe reputational damage to the organization.

Immediate Action: Review the official Kentico hotfix portal and apply the latest security updates provided by the vendor for your specific version of Xperience.

Proactive Monitoring: Inspect web server logs for suspicious file uploads or access patterns originating from non-administrative user accounts that should not have write access to sensitive directories.

Compensating Controls: Implement strict file extension validation and content type filtering at the Web Application Firewall (WAF) level to prevent the upload of executable or script-based files.

Public Exploit Available: Unknown

Given the high CVSS severity and the potential for complete system takeover, organizations using Kentico Xperience must prioritize patching. Administrators should audit the "Read data" permissions to ensure that only trusted accounts can interact with form components until the necessary security updates are fully deployed.