A chain of vulnerabilities in Sitecore Experience Platform (XP) allows remote code execution without authentication, risking widespread server hijacking. Attackers can exploit a built-in user, a Zip Slip flaw, and a PowerShell extension vulnerability to compromise systems—impacting thousands of enterprise organizations. #SitecoreXP #ZipSlip #PowerShellExtensions
Keypoints
- A chain of three vulnerabilities enables remote code execution on Sitecore XP versions 10.1 to 10.4.
- The attack exploits a hardcoded password for an internal user and bypasses backend login checks.
- With initial access, attackers use a Zip Slip flaw to upload malicious webshells into the webroot.
- The presence of the PowerShell Extensions module allows straightforward file uploads bypassing restrictions.
- Patches were released in May 2025, but exploitation risks remain due to detailed publicly available technical information.