Unrestricted File Upload Vulnerability in Kibana by Elastic
CVE-2025-25016

4.3MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
1 May 2025

What is CVE-2025-25016?

The unrestricted file upload vulnerability in Kibana enables authenticated attackers to upload malicious files due to inadequate server-side validation. This flaw poses a significant risk as it compromises the integrity of the software, allowing potential execution of arbitrary code or manipulation of the system. Users should promptly update to secure versions to mitigate this threat.

Affected Version(s)

Kibana 7.17.0 < 7.17.18

Kibana 8.0.0 < 8.13.0

References

https://discuss.elastic.co/t/kibana-7-17-19-and-8-13-0-se...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-25016 : Unrestricted File Upload Vulnerability in Kibana by Elastic