CVE-2025-25015

published 2025-03-05

CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0…

Priority P2 63 critical 9.9 CVSS 3.1

AV N AC L PR L UI N S C C H I H A H

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.
In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors

Affected

2 ranges

Vendor	Product	Version range	Fixed in
elastic	kibana	>= 8.15.0 < 8.16.6	8.16.6
elastic	kibana	>= 8.17.0 < 8.17.3	8.17.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1321