CVE-2025-25012

Description

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors

References

https://thehackernews.com/2025/03/elastic-releases-urgent-fix-for.html

https://securityaffairs.com/174999/security/elastic-kibana-critical-flaw.html

https://discuss.elastic.co/t/kibana-8-17-3-security-update-esa-2025-06/375441

https://securityonline.info/cve-2025-25012-cvss-9-9-critical-code-execution-vulnerability-patched-in-elastic-kibana/#google_vignette

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3