PT-2025-40995 · Elastic · Kibana

Published 2025-10-06 · Updated 2025-10-30 · CVE-2025-25009

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kibana versions 8.18.8 through 8.19.5 Kibana versions 9.0.8 through 9.1.5

Description The software contains an issue related to the improper neutralization of input during web page generation. This can lead to Stored Cross-Site Scripting (XSS) when a case file is uploaded. An attacker can inject scripts through the uploaded file, resulting in persistent XSS. The vulnerability stems from insufficient input handling.

Recommendations Upgrade to Kibana version 8.18.8. Upgrade to Kibana version 8.19.5. Upgrade to Kibana version 9.0.8. Upgrade to Kibana version 9.1.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-12640

BIT-ELK-2025-25009

BIT-KIBANA-2025-25009

CVE-2025-25009

Affected Products

Kibana

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-25009 · Security Note
• https://osv.dev/vulnerability/BIT-elk-2025-25009 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kibana-2025-25009 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25009 · Vendor Advisory
• https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12640 · Security Note
• https://twitter.com/Hossted_OSS/status/1980182605413978252 · Twitter Post
• https://twitter.com/autumn_good_35/status/1975932822570545181 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1975629453502894250 · Twitter Post
• https://twitter.com/CveFindCom/status/1975564641523597628 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1980180345124508039 · Twitter Post
• https://t.me/cveNotify/140961 · Telegram Post
• https://t.me/CVEtracker/34316 · Telegram Post
• https://twitter.com/CVEnew/status/1975571167269318880 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1975982987394040147 · Twitter Post