Introduction
Stored JavaScript payloads in Kibana's Fleet and Integrations interface can compromise administrative dashboards and let attackers hijack sessions or exfiltrate sensitive monitoring data. The vulnerability is tracked as CVE-2025-25018 and rated high severity. It affects a broad range of Kibana deployments, and security teams that manage Elastic Stack environments should treat it as urgent.
About Elastic and Kibana: Elastic builds search, observability, and security products. Kibana is the primary visualization and management interface for Elasticsearch, widely used for log analytics, security monitoring, and business intelligence. Thousands of organizations worldwide deploy Elastic's products, so a vulnerability in Kibana reaches across many industries.
Technical information
CVE-2025-25018 is a stored Cross-Site Scripting (XSS) vulnerability in Kibana's Fleet and Integrations management interface. The flaw comes from improper neutralization of user input during web page generation, specifically where configuration data is stored and later rendered in the browser. An attacker whose role has 'All' permissions under Management for Fleet and Integrations can inject malicious JavaScript into configuration fields or other stored data. When another user with access to those interface elements loads an affected page, the injected script runs in that user's browser context.
This opens several attack scenarios:
- Session hijacking by stealing authentication cookies
- Exfiltration of sensitive dashboard or monitoring data
- Privilege escalation if higher-privileged users access the compromised interface
The payload is persistent. It stays stored in the application until someone removes it or the system is patched. The root cause is insufficient input validation and output encoding for user-supplied data rendered in dynamic web pages. No public code snippets or proof of concept are available as of this writing. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).
Patch information
Elastic has released fixes for the stored XSS vulnerability in Kibana versions 8.18.8, 8.19.5, 9.0.8, and 9.1.5. The updates strengthen input validation so malicious scripts cannot be stored and executed in the application.
If you cannot upgrade immediately, restrict roles that include 'All' permissions under Management for Fleet and Integrations, because exploitation depends on that configuration. Either upgrading or restricting those roles mitigates the risk.
Patch source: Elastic Security Advisory
Affected systems and versions
CVE-2025-25018 affects the following Kibana versions:
- All 7.x versions up to and including 7.17.29
- All 8.x versions up to and including 8.18.7
- 8.19.0 through 8.19.4
- 9.0.0 through 9.0.7
- 9.1.0 through 9.1.4
The attacker must have a role with 'All' permissions under Management for Fleet and Integrations. Systems that assign that privilege broadly are at higher risk.
Vendor security history
Elastic has previously fixed multiple XSS vulnerabilities in Kibana, including:
- CVE-2020-7017 (XSS in region map visualization)
- CVE-2020-7015 (stored XSS in TSVB visualization)
- CVE-2025-25009 (stored XSS in case file upload, patched in the same advisory as CVE-2025-25018)
Elastic usually ships timely patches and publishes detailed advisories. XSS keeps recurring in Kibana, which shows how hard input validation and output encoding remain in a large web application.
