Description

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-21T21:17:04.503Z",
  "pubdate": "2026-08-21T21:17:04.503Z",
  "executiveSummary": "An HTML injection vulnerability has been identified in Esri Portal for ArcGIS versions 11.3 and prior. This security flaw enables a remote attacker possessing administrative privileges to inject arbitrary HTML payloads into the administrative API components of the application. The primary impact of this vulnerability involves the potential rendering of malicious markup within the administrative interface, which could facilitate secondary exploitation vectors such as cross-site scripting (XSS), session manipulation, or unauthorized content modification depending on how the input is processed and rendered by administrative browsers.\nThe affected products include Esri Portal for ArcGIS, specifically versions 11.1 and 11.3, though all versions 11.3 and prior are susceptible. Risk implications center around the compromise of the administrative trust boundary, as malicious content injected into the administrative API could deceive administrators or manipulate the management plane of ArcGIS Enterprise. Successful exploitation requires authenticated access with administrative privileges, meaning an attacker must first compromise or provision high-level administrative credentials to interact with the vulnerable administrative API endpoints before executing the injection attack.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and improper output encoding of user-supplied data within the administrative API of Esri Portal for ArcGIS versions 11.3 and prior. When administrators submit configuration data or interact with specific API functions, the application fails to adequately neutralize HTML tags, special characters, or script delimiters before storing and reflecting the input back through the administrative interface.\nThe vulnerable component resides within the administrative API and its associated backend handlers responsible for processing administrative requests and rendering management views. The attack vector is network-based, requiring the adversary to possess valid administrative credentials and remote access to the administrative API endpoints of the target ArcGIS Enterprise deployment.\nThe step-by-step attack flow begins with the authenticated attacker authenticating to the administrative API of Esri Portal for ArcGIS. The attacker crafts a malicious HTTP request containing arbitrary HTML payloads injected into vulnerable API parameters. Upon receiving the request, the backend application processes and stores the input without performing robust input validation or context-aware output encoding. When an administrator subsequently accesses the affected administrative API endpoint or management console, the unvalidated HTML payload is rendered by the browser within the context of the administrative session. Depending on the exact payload and browser context, this can lead to unauthorized interface manipulation, malicious script execution, or defacement of the administrative dashboard.\nPost-exploitation impact is constrained by the initial requirement for administrative privileges, but successful HTML injection within an administrative context increases the risk of privilege abuse, session hijacking via secondary script execution, or social engineering targeting other administrative users who manage the ArcGIS Enterprise environment."
}