---
title: Security advisory 2026-07-09
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## SQL injection in the Segments condition builder

**CVSS**: 8.6\
**Affected versions**: 31.4.0 - 31.6.1\
**Category**: SQL injection

### Summary

Due to insufficient validation of user-supplied input in the [segment condition builder](https://docs.kentico.com/documentation/developers-and-admins/digital-marketing-setup/customer-data-platform/segments.md) preview feature, an authorized administration user with appropriate permissions could inject SQL commands, potentially leading to modification of data or disruption of application functionality. After applying the fix, the input is validated correctly and such commands can no longer be executed.

The [contact group](https://docs.kentico.com/documentation/business-users/digital-marketing/contact-groups.md) and other condition builders in the application were not affected.

### How to fix

Update to the latest version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.

### Acknowledgments

This issue was reported by Ethan Pike.

## SQL injection through content sync

**CVSS**: 7.5\
**Affected versions**: 22.0.0 - 31.6.1\
**Category**: SQL injection

### Summary

Due to improper validation of certain form field inputs during [content synchronization](https://docs.kentico.com/documentation/business-users/content-sync.md), synchronization of form definitions between instances could have allowed unintended SQL commands to be executed, potentially leading to disruption of application functionality or compromised data integrity. Exploitation required knowledge of the content synchronization secret and was only possible on Xperience by Kentico instances [configured](https://docs.kentico.com/documentation/developers-and-admins/configuration/content-sync-configuration.md) as the target for content synchronization. After applying the fix, the field data is validated correctly, and such commands can no longer be executed.

### How to fix

Update to the latest version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.

### Acknowledgments

This issue was reported by Vũ Phạm Hải.

## Email Builder sensitive information disclosure

**CVSS**: 7.1\
**Affected versions**: 22.0.0 - 31.6.1\
**Category**: Information disclosure

### Summary

Due to improper handling of file inclusion paths passed through [Email Builder](https://docs.kentico.com/documentation/business-users/digital-marketing/emails/create-emails-in-email-builder.md) components during MJML email rendering, authenticated administration users with email editing permissions could access and read arbitrary files available to the application, potentially leading to unintended disclosure of sensitive configuration or system data.

### How to fix

Update to the latest version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.

For projects using MJML includes, configure the new options in the application's `appsettings.json` file:

- `MjmlInclude:RootPath` defines the root directory from which include files can be loaded.
- `MjmlInclude:AllowedFileExtensions` defines the allowlist of file extensions permitted for included files.

To reduce security risk, set `RootPath` to a dedicated folder containing only trusted include files (for example `~/EmailComponents`) and keep `AllowedFileExtensions` as restrictive as possible, ideally only to extensions that are actually used in includes within Email Builder components.

```json title="appsettings.json"
"MjmlInclude": {
  "RootPath": "~/EmailComponents",
  "AllowedFileExtensions": [".mjml", ".css"]
}
```

See [Configure MJML includes](https://docs.kentico.com/documentation/developers-and-admins/development/builders/email-builder/develop-email-builder-components.md#configure-mjml-includes) for details.

### Acknowledgments

This issue was reported by Vũ Phạm Hải.