← Back

CVE-2026-72677

nvd nist
Published: Aug 13, 2026Modified: Sep 2, 2026

JSON object

Loading...
7.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Exploitability: 2.1 / Impact: 5.2
Source: security@elastic.co (Secondary)

Description

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

Affected (3)

Products: Elastic: Kibana
Elastic
1 product
Kibana
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Elastic
Kibana
From 8.0.0 to 8.19.17
Kibana
From 9.0.0 to 9.3.6
Kibana
From 9.4.0 to 9.4.3

Related CWEs

CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (1)

Source: security@elastic.co
Vendor Advisory

Timeline

No history available yet.