UpHeron
All vulnerabilities

Servers and applications

CVE-2025-34510

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

Severity
High 8.8
Published
17 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.4
Sources
NVD

Affected software

SoftwareAffected versions
Sitecore Experience PlatformServers and applications · cpe:a:sitecore:experience_manager
  • From 9.0 up to 10.4
Sitecore Experience PlatformServers and applications · cpe:a:sitecore:experience_platform
  • From 9.0 before 10.4
  • Version 10.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-34510
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-34510