The security threat pertains to a Cross Site Scripting (XSS) vulnerability identified in Kentico Xperience version 13.0.178 and earlier. Kentico Xperience is a widely used web content management system (CMS) and digital experience platform. The vulnerability allows an attacker to upload a specially crafted ZIP archive containing an SVG file with embedded malicious JavaScript code. The exploit leverages an unauthenticated file upload endpoint, specifically targeting the MultiFileUploader.ashx handler, by sending a POST request with the ZIP file. Upon successful upload, the malicious SVG file can be rendered by the application or viewed by users, triggering the embedded JavaScript payload. This results in the execution of arbitrary scripts in the context of the victim's browser, enabling theft of session cookies, defacement, or redirection to malicious sites. The provided exploit code is written in Python 3 and automates the creation of the malicious SVG payload, packaging it into a ZIP archive, and uploading it to the vulnerable endpoint. The vulnerability is identified as CVE-2025-32370. No authentication or user interaction is required to exploit this vulnerability, increasing its risk profile. The vulnerability is classified as medium severity, reflecting the typical impact of XSS attacks combined with the ease of exploitation through unauthenticated upload. No official patch links are provided, indicating that mitigation may require manual intervention or vendor updates. The exploit does not appear to be widely exploited in the wild yet, but the availability of proof-of-concept code increases the likelihood of future attacks.

For European organizations using Kentico Xperience 13.0.178 or earlier, this vulnerability poses a significant risk to web application security and user trust. Successful exploitation can lead to session hijacking, unauthorized actions performed on behalf of users, data leakage, and reputational damage. Since the vulnerability allows unauthenticated attackers to upload malicious content, it can be leveraged to target both internal users and external customers. This is particularly concerning for organizations handling sensitive personal data under GDPR, as XSS attacks can facilitate data breaches. The impact extends to potential regulatory fines and loss of customer confidence. Additionally, attackers may use the vulnerability as a foothold to escalate attacks within the network or distribute malware. The medium severity rating suggests that while the vulnerability is serious, it may not directly lead to full system compromise without additional vulnerabilities. However, the ease of exploitation and the public availability of exploit code increase the urgency for mitigation.

1. Immediate upgrade to the latest Kentico Xperience version where this vulnerability is patched. If an official patch is not yet available, contact Kentico support for guidance or apply vendor-recommended workarounds. 2. Implement strict server-side validation and sanitization of uploaded files, especially SVG content, to prevent embedded scripts from executing. 3. Restrict file upload types and enforce content-type validation to disallow SVG or other potentially dangerous file formats unless absolutely necessary. 4. Employ Content Security Policy (CSP) headers to restrict the execution of inline scripts and reduce the impact of XSS attacks. 5. Use Web Application Firewalls (WAF) with rules tuned to detect and block malicious upload attempts and suspicious SVG payloads. 6. Monitor web server logs for unusual POST requests to the MultiFileUploader.ashx endpoint and investigate any anomalies. 7. Educate developers and administrators about secure file upload handling and XSS prevention best practices. 8. Consider disabling or restricting the vulnerable upload endpoint if it is not essential for business operations until a patch is applied.