CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

High 8.8 Published 17 Jun 2025 Updated 26 Feb 2026

Authenticated attackers can achieve remote code execution in Sitecore XM, XC, and XP by uploading malicious ZIP archives with path traversal sequences.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-34510?

CVE-2025-34510 is a high-severity path traversal vulnerability in Sitecore Experience Commerce, published on 17 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

Weakness: CWE-23

Which versions are affected by CVE-2025-34510?

It affects 4 products.

Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.

How do I fix CVE-2025-34510?

No fix has been published for CVE-2025-34510 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-34510 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34510 exists.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-mh69-97fr-wj66.