CVE-2025-25015 — Kibana arbitrary code execution via prototype pollution

CVE-2025-25015

Kibana arbitrary code execution via prototype pollution PUBLISHED

Description (CNA)

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 8.15.0 before 8.16.6; affected 8.17.0 before 8.17.3

CWE

CWE-1321

References

https://discuss.elastic.co/t/kibana-8-17-3-8-16-6-security-update-esa-2025-06/375441

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.