High · 8.7 CVE-2025-25009 EUVD-2025-32075GHSA-q2gp-8vqw-v8h2

Kibana Cross-Site Scripting (XSS)

Published Oct 7, 2025 · Updated Oct 7, 2025 · Assigned by elastic

Description

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

Vendor	Product	Affected	Fixed
Elastic	Kibana	7.0.0 – ≤ 7.17.29, 8.14.0 – ≤ 8.18.7, 8.19.0 – ≤ 8.19.4, 9.0.0 – ≤ 9.0.7, 9.1.0 – ≤ 9.1.4	—