CVE-2025-25016

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
ElasticKibana>= 7.17.0, < 7.17.18; >= 8.0.0, < 8.13.0

References

Timeline

Published
May 1, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-250176.1Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)CVE-2025-250185.4Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)CVE-2025-250196.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session aCVE-2025-25027.8An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-250206.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated CVE-2025-250217.2IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execCVE-2025-250228.8IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticateCVE-2025-250234.9IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.CVE-2025-250255.3IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returnedCVE-2025-250264.3IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.CVE-2025-250296.5IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.CVE-2025-25037.1An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file