CVE-2022-50686 Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure

What is CVE-2022-50686?

CVE-2022-50686 is a medium-severity vulnerability in Kentico Xperience, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages. Detailed error messages can expose internal system information and potentially reveal implementation details to unauthorized users.

Weakness: CWE-209

Which versions are affected by CVE-2022-50686?

It affects 1 product.

Products include Kentico Xperience.

How do I fix CVE-2022-50686?

No fix has been published for CVE-2022-50686 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-50686 being exploited?

There is no known exploitation of CVE-2022-50686 in the wild and no public exploit code.

Other vulnerabilities in Kentico Xperience

• CVE-2025-2746 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Exploited Critical 9.8
• CVE-2025-2747 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Exploited Critical 9.8
• CVE-2019-10068 Kentico Xperience Deserialization of Untrusted Data Exploited Critical 9.8
• CVE-2025-2749 Kentico Xperience Path Traversal Exploited High 7.2
• CVE-2017-17736 Missing authorization in n/a Critical 9.8

All Kentico Xperience vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6j36-r33q-6mrw.