Description

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-13T20:17:28.373Z",
  "pubdate": "2026-08-13T20:17:28.373Z",
  "executiveSummary": "A vulnerability classified as Relative Path Traversal (CWE-23) exists in Kibana Fleet, specifically through CAPEC-139, potentially leading to unauthorized resource deletion.\nThe flaw affects Kibana Fleet by accepting unvalidated user-supplied identifiers for Fleet Server host configurations without properly sanitizing relative traversal sequences.\nBecause the application stores the raw identifier and subsequently incorporates it into internal requests when the configuration is removed, an authenticated attacker with permissions to manage Fleet Server host configurations can manipulate the deletion process.\nThis behavior exposes the system to unauthorized file deletion risks, depending on how the constructed path resolves on the underlying filesystem or backend API during the removal operation.\nThe risk implications involve loss of data integrity, potential deletion of critical system or application resources, and unauthorized state manipulation within the Kibana environment.\nExploitation requires the ability to supply malicious path traversal sequences via the host configuration identifier and trigger the associated removal workflow.",
  "technicalDetails": "The root cause of the vulnerability lies in insufficient input validation and sanitization within the Kibana Fleet component handling Fleet Server host configurations.\nSpecifically, the input field accepting the user-supplied identifier fails to strip, filter, or reject relative traversal sequences such as dot-dot-slash patterns.\nConsequently, the application treats the malicious traversal string as a valid identifier, persisting the untrusted input directly into the storage layer without normalization.\nThe exploitation method leverages this stored malicious identifier during the resource removal lifecycle.\nWhen an administrator or authorized user initiates the removal of the Fleet Server host configuration, Kibana retrieves the stored identifier and dynamically incorporates it into the construction of the outgoing request path.\nBecause the traversal sequences are preserved, the resulting request path navigates outside the intended directory or resource boundary.\nThe attack flow proceeds as follows: first, the adversary creates or updates a Fleet Server host configuration, injecting relative path traversal sequences into the identifier parameter.\nSecond, the application accepts and stores the payload without validation.\nThird, upon triggering the removal of the affected configuration, Kibana appends the malicious identifier to the base deletion path.\nFinally, the resulting traversal payload directs the deletion request to an unintended target location, executing unauthorized resource deletion on the backend.\nThe vulnerable component is the Kibana Fleet Server host configuration identifier handling and removal mechanism.\nThe payload behavior involves traversing directory levels or logical resource hierarchies to target arbitrary resources during the deletion phase.\nThe post-exploitation impact includes the unauthorized destruction of arbitrary files or resources accessible within the execution context of the deletion operation, potentially causing application instability or data loss."
}