CVE-2025-25016

MEDIUM4.3EPSS 0.19%

Kibana Unrestricted Upload of File

Published: 5/3/2025Modified: 5/20/2025

Also known as:BIT-elk-2025-25016BIT-kibana-2025-25016

Description

Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

Affected packages (2)

Bitnami/elk>= 7.17.0, < 7.17.18, >= 8.0.0, < 8.13.0
Bitnami/kibana>= 7.17.0, < 7.17.18, >= 8.0.0, < 8.13.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References (2)

WEBhttps://discuss.elastic.co/t/kibana-7-17-19-and-8-13-0-security-update-esa-2024-47/377711
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2025-25016