Kentico Xperience Stored Cross-Site Scripting Vulnerability via Spoofed Content-Type in File Uploads

A stored cross-site scripting vulnerability has been identified in Kentico Xperience versions through 12.0.49. This vulnerability allows attackers to upload files with manipulated Content-Types that do not correspond to the actual file extensions. Exploitation of this issue could lead to the execution of malicious scripts in the browsers of users who access the uploaded files.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded files can execute malicious scripts in the context of the user’s browser.

Remediation

Users can upgrade to Kentico Xperience version 13.0.198 or later, where this vulnerability has been addressed. Instructions for applying hotfixes are available on the Kentico Xperience documentation site.