CVE-2025-34139 Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read
Unauthenticated attackers can read arbitrary files from Sitecore Experience Platform instances, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34139?
CVE-2025-34139 is a high-severity path traversal vulnerability in Sitecore Experience Commerce (XC), published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.
Which versions are affected by CVE-2025-34139?
How do I fix CVE-2025-34139?
No fix has been published for CVE-2025-34139 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-34139 being exploited?
There is no known exploitation of CVE-2025-34139 in the wild and no public exploit code.
Sources
Also known as GHSA-wjf7-6cx7-x9v8.