# CVE-2025-34510: Sitecore - Path Traversal

> Live exploitation tracking for CVE-2025-34510 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34510

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Experience Commerce
- **Weaknesses:** CWE-23 (Relative Path Traversal)
- **Tags:** cms

## Description

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

## CrowdSec analysis

[CVE-2025-34510](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34510) is a path traversal vulnerability in Sitecore Experience Manager versions 9.0 through 9.3 and 10.0 through 10.4. THe vulnerability allows remote attackers to upload arbitrary zip-encoded payloads to a given endpoint, leading to potential system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 20th of June 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-34510 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-34510 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed attack attempts focus on URLs containing `/sitecore/shell/applications/dialogs/upload/upload2.aspx` to upload a malicious Zip file to the target.

## Timeline

- 2025-06-17: CVE Published. CVE-2025-34510 is published to NVD.
- 2025-06-20: Rule Released. CrowdSec releases a rule to detect CVE-2025-34510 exploitation attempts against the CrowdSec Network.
- 2025-09-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34510 for the first time.

## References

- https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34510) follows observed exploitation activity for CVE-2025-34510. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.