CVE-2018-7046 Code injection in n/a
Authenticated users can execute arbitrary OS commands via C# code injection in the CMS template editor, though the vendor claims this is intended functionality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7046?
CVE-2018-7046 is a high-severity code injection vulnerability in Kentico Xperience, published on 20 Feb 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
Weakness: CWE-78
Which versions are affected by CVE-2018-7046?
It affects 1 product.
Products include Kentico Xperience.
How do I fix CVE-2018-7046?
No fix has been published for CVE-2018-7046 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-7046 being exploited?
There is no known exploitation of CVE-2018-7046 in the wild and no public exploit code.
Other vulnerabilities in Kentico Xperience
- CVE-2025-2746 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel
- CVE-2025-2747 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel
- CVE-2019-10068 Kentico Xperience Deserialization of Untrusted Data
- CVE-2025-2749 Kentico Xperience Path Traversal
- CVE-2017-17736 Missing authorization in n/a
Sources
Also known as GHSA-c9vh-h87x-7r85.