CVE-2025-34510

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip path traversal flaw (CWE-23) in archive upload handling. A remote attacker with valid low-privilege credentials can send a crafted HTTP request that uploads a ZIP archive containing path traversal sequences, causing files to be written outside the intended upload directory to attacker-chosen paths. By writing web-accessible or executable content into those locations, the attacker achieves arbitrary code execution on the server. Any organization running affected Sitecore versions is exposed, with internet-facing CMS deployments at greatest risk. The flaw is not yet listed in CISA's KEV catalog, but public WatchTowr research demonstrates a pre-authentication RCE chain that incorporates it, and EPSS assigns a ~24% probability of exploitation within the next 30 days (98th percentile).

What to do: Upgrade to the latest patched builds within your 9.x or 10.x release line per Sitecore's security bulletin for CVE-2025-34510, prioritizing internet-facing instances. Until patched, restrict the archive upload functionality to trusted users, monitor for unexpected ZIP uploads and files written outside intended upload directories (especially in the web root), and review logs for the chained pre-auth techniques (cache poisoning and hardcoded-credential abuse) described in the WatchTowr research.