PT-2025-40995

CVE-2025-25009

Published

2025-10-06

Updated

2025-10-30

Description by

CVSS 3.1

8.7

High

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kibana versions 8.18.8 through 8.19.5 Kibana versions 9.0.8 through 9.1.5

Description The software contains an issue related to the improper neutralization of input during web page generation. This can lead to Stored Cross-Site Scripting (XSS) when a case file is uploaded. An attacker can inject scripts through the uploaded file, resulting in persistent XSS. The vulnerability stems from insufficient input handling.

Recommendations Upgrade to Kibana version 8.18.8. Upgrade to Kibana version 8.19.5. Upgrade to Kibana version 9.0.8. Upgrade to Kibana version 9.1.5.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2025-25009

BDU:2025-12640

BIT-ELK-2025-25009