---
id: CVE-2025-34511
title: Sitecore PowerShell Extension RCE via Unrestricted Upload
summary: >-
  Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM)
  and Experience Platform (XP), through version 7.0 is vulnerable to an
  unrestricted file upload issue. A remote, authenticated attacker can upload
  arbitrary fil…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-434
vendor: Sitecore
product: Powershell Extension
affected:
  - powershell_extension <= 7.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-06-18T03:56:11.522059Z'
exploitAvailable: true
published: '2025-06-17'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:02:59.711Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-34511'
references:
  - url: >-
      https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/
  - url: >-
      https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
tags:
  - cve.org
  - exploit-available
epss: 0.30446
epssPercentile: 0.98248
exploits:
  metasploit:
    - exploit/windows/http/sitecore_xp_cve_2025_34511
  checkedAt: '2026-11-09T19:59:41.309Z'
ingestedAt: '2026-11-05T20:33:06.553Z'
---

## Overview

Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.

## Affected

- `powershell_extension <= 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.