Stored Cross-Site Scripting Vulnerability in Esri Portal for ArcGIS Enterprise Sites

CVE-2025-55107

What is CVE-2025-55107?

A stored Cross-site Scripting vulnerability exists in Esri Portal for ArcGIS Enterprise Sites, versions 10.9.1 to 11.4, which enables a remote, authenticated attacker to inject a malicious file with embedded XSS scripts. When the compromised file is accessed, arbitrary JavaScript code could be executed within the victim's browser. This vulnerability could lead to the exposure of sensitive information, including privileged tokens, potentially allowing the attacker to gain unauthorized control over the Portal.

References