Sitecore - Path Traversal (CVE-2025-34510)
Description
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
psychologyCrowdSec Analysis
CVE-2025-34510 is a path traversal vulnerability in Sitecore Experience Manager versions 9.0 through 9.3 and 10.0 through 10.4. THe vulnerability allows remote attackers to upload arbitrary zip-encoded payloads to a given endpoint, leading to potential system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 20th of June 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-34510 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-34510 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Observed attack attempts focus on URLs containing /sitecore/shell/applications/dialogs/upload/upload2.aspx to upload a malicious Zip file to the target.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-06-17 |
| Rule Released | 2025-06-20 |
| CrowdSec First Seen | 2025-09-20 |