PT-2025-41308 · Elastic · Kibana

Published 2025-10-08 · Updated 2025-12-18 · CVE-2025-25018

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kibana versions 8.18.8, 8.19.5, 9.0.8, and 9.1.5

Description An issue exists in Kibana where improper neutralization of input during web page generation and improper validation of specified input types can lead to stored Cross-Site Scripting (XSS). This allows an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update Kibana to version 8.18.8. Update Kibana to version 8.19.5. Update Kibana to version 9.0.8. Update Kibana to version 9.1.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-ELK-2025-25018

BIT-KIBANA-2025-25018

CVE-2025-25018

Affected Products

Kibana

References · 16

• https://osv.dev/vulnerability/BIT-elk-2025-25018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25018 · Security Note
• https://osv.dev/vulnerability/BIT-kibana-2025-25018 · Vendor Advisory
• https://https//discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451 · Vendor Advisory
• https://t.me/cveNotify/146146 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000530726186340454 · Twitter Post
• https://t.me/CVEtracker/34560 · Telegram Post
• https://twitter.com/autumn_good_35/status/1975932334643065166 · Twitter Post
• https://twitter.com/CVEnew/status/1976592786498748907 · Twitter Post
• https://twitter.com/CveTodo/status/1976596634650714293 · Twitter Post
• https://t.me/CVEtracker/39822 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1976600122118025524 · Twitter Post
• https://twitter.com/cracbot/status/1978415603770876294 · Twitter Post
• https://t.me/cveNotify/140947 · Telegram Post