CVE-2025-25016— Kibana Unrestricted Upload of File
Quick assessment
Affected
Elastic Kibana
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elastic Kibana是Elastic公司的一个可用数据可视化仪表板软件。 Elastic Kibana 8.13.0之前版本存在安全漏洞，该漏洞源于服务器端验证不足导致认证攻击者可上传恶意文件。
Possible ATT&CK Techniques 1 AI
T1195 · Supply Chain Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-25016
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kibana Unrestricted Upload of File
Source: CVE Program / CVE List V5
Vulnerability Description
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
Elastic Kibana 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Elastic Kibana是Elastic公司的一个可用数据可视化仪表板软件。 Elastic Kibana 8.13.0之前版本存在安全漏洞，该漏洞源于服务器端验证不足导致认证攻击者可上传恶意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-25016
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-25016
请登录查看更多情报信息。
Other References for CVE-2025-25016 (1)
Same Patch Batch · Elastic · 2025-05-01 · 6 CVEs total
| CVE-2024-52979 | 6.5 MEDIUM | Elasticsearch Uncontrolled Resource Consumption vulnerability |
| CVE-2023-46669 | 6.2 MEDIUM | Elastic Agent / Elastic Endpoint Security local API key disclosure |
| CVE-2024-11994 | 5.7 MEDIUM | APM Server Insertion of Sensitive Information into Log File |
| CVE-2024-11390 | 5.4 MEDIUM | Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS |
| CVE-2024-52976 | 4.4 MEDIUM | Elastic Agent Inclusion of Functionality from Untrusted Control Sphere |
IV. Related Vulnerabilities
Same product: Kibana
-
CVE-2026-94400
Uncontrolled Resource Consumption in Kibana Leading to denia -
CVE-2026-78582
Missing Authorization in Kibana Leading to Unauthorized Dele -
CVE-2026-72662
Authorization Bypass Through User-Controlled Key in Kibana L -
CVE-2026-72668
Unintended Proxy or Intermediary ('Confused Deputy') in Kiba -
CVE-2026-82302
Incorrect Authorization in Kibana Leading to Unauthorized Co
Same vendor: Elastic
-
CVE-2026-94408
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94397
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94396
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94400
Uncontrolled Resource Consumption in Kibana Leading to denia -
CVE-2026-94399
Uncontrolled Resource Consumption in Elasticsearch Leading t
Same weakness: CWE-434
-
CVE-2026-105123
W (wcms) through 3.18.0 RCE and Arbitrary File Write via Med -
CVE-2023-54405
H3C CVM Unauthenticated File Upload via fileUpload/upload To -
CVE-2026-104637
onetwothreeneth HospitalManagementSystem controller.php edit -
CVE-2026-104471
YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV -
CVE-2026-92820
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbit
V. Comments for CVE-2025-25016
No comments yet