Introduction
Malicious file uploads in Kibana's case management can silently compromise user sessions and expose sensitive operational data. Organizations that use Kibana for security analytics and incident response are at risk until they address a recently disclosed stored XSS vulnerability.
About Kibana and Elastic: Kibana is the primary visualization and analytics interface for Elasticsearch, part of the Elastic Stack. Elastic makes search and analytics software with millions of users worldwide, and its products are widely used in enterprise observability, security, and data analysis. Security operations centers, IT monitoring teams, and business analytics groups depend on Kibana.
Technical Information
CVE-2025-25009 is a stored cross-site scripting vulnerability in Kibana's case file upload feature. It comes from improper neutralization of user-supplied input during web page generation (CWE-79). An authenticated user with file upload privileges can upload a file containing malicious JavaScript. When another user views the affected case in Kibana, the script runs in that user's browser context.
This can lead to:
- Session hijacking (by stealing session cookies)
- Data theft (exfiltrating information visible in the Kibana UI)
- Privilege escalation (if the victim has higher privileges)
The root cause is insufficient input validation and output encoding in the code that handles and renders uploaded case files. No public code snippets are available for this vulnerability. Exploitation requires authenticated access with file upload permissions.
Patch Information
Elastic fixed CVE-2025-25009 in these versions:
- 8.18.8
- 8.19.5
- 9.0.8
- 9.1.5
The updates improve input validation and output encoding for case file uploads, so user-supplied content is properly sanitized before the browser renders it. Organizations should upgrade to the relevant fixed version as soon as possible.
For Kibana 7.12 through 8.19.0, a temporary workaround is to enable the advanced setting discover:searchFieldsFromSource: true. No workaround exists for 9.0 and later. Those versions must be patched immediately.
Patch sources:
- https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451
- https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449
Affected Systems and Versions
CVE-2025-25009 affects these Kibana versions:
- 7.x up to and including 7.17.29
- 8.0.0 through 8.18.7
- 8.19.0 through 8.19.4
- 9.0.0 through 9.0.7
- 9.1.0 through 9.1.4
Any configuration that gives users file upload privileges in case management is vulnerable.
Vendor Security History
Kibana and Elastic have a documented history of XSS and related vulnerabilities, including:
- CVE-2019-7609: Arbitrary code execution in Timelion visualizer (CVSS 10.0)
- CVE-2022-23713: XSS in Vega Charts integration
- CVE-2018-3820, CVE-2018-3821, CVE-2017-8440: Various XSS issues in visualization components
Elastic usually responds quickly to reported vulnerabilities and issues patches and advisories across its supported version branches. Those advisories include detailed technical and mitigation information.
