Stored Cross-site Scripting Vulnerability in Esri Portal for ArcGIS Enterprise

CVE-2025-55105

What is CVE-2025-55105?

The vulnerability in Esri Portal for ArcGIS Enterprise allows authenticated attackers to exploit a stored cross-site scripting flaw. By injecting a malicious file containing an embedded XSS script, an attacker can execute arbitrary JavaScript code in the browser of victims accessing the compromised portal. This attack may lead to the exposure of sensitive information, such as privileged tokens, potentially granting the attacker full control over the affected Portal. Remediation is crucial to safeguard user data and maintain the integrity of the application.

References