Stored Cross-site Scripting Vulnerability in Esri Portal for ArcGIS Enterprise Sites

CVE-2025-55106

What is CVE-2025-55106?

A stored Cross-site Scripting (XSS) vulnerability exists in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 through 11.4. This flaw could allow a remote, authenticated attacker to inject a malicious file containing an XSS script. When loaded, this script may execute arbitrary JavaScript code in the victim’s browser. The exploitation of this vulnerability may lead to the disclosure of privileged tokens, potentially granting the attacker full control over the Portal.

References