Description
It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 7.9.0 – < 7.14.0 | 7.14.0 |
Advisories 1
- WID-SEC-2022-0029 Elasticsearch und Kibana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026