Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2025-25018

Kibana Stored Cross-Site Scripting (XSS)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Kibana

Default version status: unaffected

  • 7.0.0 to ≤ 7.17.29affected
  • 8.0.0 to ≤ 8.18.7affected
  • 8.19.0 to ≤ 8.19.4affected
  • 9.0.0 to ≤ 9.0.7affected
  • 9.1.0 to ≤ 9.1.4affected

References