← Back

CVE-2025-34511

nvd nist
Published: Jun 17, 2025Modified: Sep 8, 2025

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: disclosure@vulncheck.com (Secondary)

Description

Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.

Affected (5)

Sitecore
4 products
Experience Commerce
Experience Manager
Experience Platform
Managed Cloud
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Experience Commerce
From 9.0 to 10.4
Experience Manager
From 9.0 to 10.4
Sitecore
Experience Platform
From 9.0 to 10.4
Experience Platform
Version 10.4
Managed Cloud
All versions

Related CWEs

CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

Source: disclosure@vulncheck.com
ExploitThird Party Advisory
Source: disclosure@vulncheck.com
Vendor Advisory

Timeline

No history available yet.