PT-2026-34881 · Elastic+1 · Elasticsearch7+1

Published 2026-04-24 · Updated 2026-04-25 · CVE-2025-61872

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 25.04.2 Mahara versions prior to 24.04.11

Description The 'search site' feature, when utilizing the Elasticsearch7 search plugin, allows for Cross-Site Scripting (XSS)—a flaw where malicious scripts are injected into trusted websites—due to improper sanitization of input in the query parameter.

Recommendations Update to version 25.04.2 or later. Update to version 24.04.11 or later. As a temporary workaround, restrict the use of the Elasticsearch7 search plugin.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61872

Affected Products

Elasticsearch7

Mahara

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-61872 · Security Note
• https://twitter.com/CVEnew/status/2048099353265381524 · Twitter Post
• https://mahara.org · Note
• https://twitter.com/infoflowcloud/status/2048101341612912916 · Twitter Post
• https://mahara.org/interaction/forum/topic.php?id=9851 · Note