Elastic Kibana CVE-2025-37732

Exploitation requires an authenticated Kibana account with access to the integration package upload functionality - per CVSS PR:L the attacker must be authenticated, and per UI:R a separate victim user must subsequently render the malicious page for the injected HTML to execute. The specific feature required is the integration package upload capability; this is the same code path addressed (incompletely) by ESA-2025-17 / CVE-2025-25018, and this issue bypasses that fix to achieve HTML injection. Limiting factors that reduce real-world risk: the need for valid upload privileges, the dependency on victim interaction, and impact confined to in-browser HTML/script rendering rather than server compromise.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 MEDIUM) describes a network-reachable but authenticated (PR:L) stored/HTML-injection XSS that requires victim user interaction (UI:R) and yields only low confidentiality and integrity impact with a changed scope. All exploitation signals point low: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' These signals are consistent (low probability, no active exploitation, limited impact), with no major conflicts. The one notable contextual factor is that this CVE is explicitly a bypass of the fix for ESA-2025-17 (CVE-2025-25018), meaning a prior patch was insufficient; this slightly raises attention value because it demonstrates a recurring injection path in the integration package upload feature. Overall: a real, patch-worthy flaw in widely deployed software, but the authentication requirement, required user interaction, and low EPSS place it well below critical, likely exploited bugs in remediation priority.

An authenticated Kibana user with access to the integration package upload functionality uploads a crafted integration package containing HTML markup that is not properly neutralized. When another user's browser renders the affected Kibana page, the injected HTML executes in that user's session context. No public exploit code was identified, and successful exploitation depends on a victim viewing the malicious content (UI:R).