CVE-2025-34511

HIGH EXPLOITED

Sitecore XP CVE-2025-34511 Post-Authentication File Upload

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2025-34511 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Piotr Bazydlo, msutovsky-r7, including a Metasploit module exploits/windows/http/sitecore_xp_cve_2025_34511.

AI-analyzed exploit summary This Metasploit module exploits CVE-2025-34511, a file upload vulnerability in Sitecore XP's PowerShell extensions, combined with CVE-2025-34509 (hardcoded credentials) to achieve post-authentication RCE. It uploads a malicious ASPX webshell and triggers it to execute the payload.

Description

Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.

Exploits (1)

metasploit WORKING POC EXCELLENT
by Piotr Bazydlo, msutovsky-r7 · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb

This Metasploit module exploits CVE-2025-34511, a file upload vulnerability in Sitecore XP's PowerShell extensions, combined with CVE-2025-34509 (hardcoded credentials) to achieve post-authentication RCE. It uploads a malicious ASPX webshell and triggers it to execute the payload.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Sitecore XP versions 10.0.0 to 10.4
Auth required
Prerequisites: Target must have PowerShell extensions installed · Hardcoded 'ServicesAPI' account with password 'b' must be present
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory third-party-advisory exploit technical-description
https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/

Scores

CVSS v3 8.8
EPSS 0.8578
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

VulnCheck KEV 2025-06-22
CWE
CWE-434
Status published
Products (5)
sitecore/experience_commerce 9.0 - 10.4
sitecore/experience_manager 9.0 - 10.4
sitecore/experience_platform 10.4
sitecore/experience_platform 9.0 - 10.4
sitecore/managed_cloud
Published Jun 17, 2025
Tracked Since Feb 18, 2026