{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-34139",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-34139",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-07-25T15:54:25.297Z",
    "updatedAt": "2025-11-19T01:28:37.079Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read",
      "summary": "A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.",
      "affected": [
        {
          "vendor": "Sitecore",
          "product": "Experience Manager (XM)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0 Initial Release",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "10.4 Initial Release and later"
            }
          ]
        },
        {
          "vendor": "Sitecore",
          "product": "Experience Platform (XP)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0 Initial Release",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "10.4 Initial Release and later"
            }
          ]
        },
        {
          "vendor": "Sitecore",
          "product": "Experience Commerce (XC)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0 Initial Release",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "10.4 Initial Release and later"
            }
          ]
        },
        {
          "vendor": "Sitecore",
          "product": "Managed Cloud",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0 Initial Release",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "10.4 Initial Release and later"
            }
          ]
        }
      ]
    }
  }
}