Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-02T15:17:40.433Z",
  "pubdate": "2026-09-02T15:17:40.433Z",
  "executiveSummary": "This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory (CWE-22), a Path Traversal flaw affecting the Kibana Fleet feature.\nThe vulnerability allows a low-privileged user possessing Fleet Settings write access to manipulate file paths, potentially resulting in the unauthorized deletion of critical, privileged resources.\nBy injecting path traversal sequences, an attacker can influence administrative operations to target unintended internal system files, organizational assets, or user accounts.\nThe exploit mechanism requires an administrative user to interact with the compromised Fleet interface, serving as a secondary trigger for the malicious action.\nThe risk implication is significant, as it enables unauthorized privilege escalation and the destruction of sensitive system data, potentially leading to a total loss of service integrity or administrative control.\nExploitation necessitates authenticated access with specific functional permissions (Fleet Settings write access), limiting the threat to internal or compromised accounts.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and validation of input parameters within the Kibana Fleet component when processing requests that specify or manipulate file system paths. By failing to restrict input to intended directories, the application remains susceptible to Path Traversal (CAPEC-126) attacks, enabling an adversary to traverse outside the designated sandbox boundaries.\nThe exploitation flow begins with a user assigned low-level permissions, specifically the capability to write to Fleet Settings. The attacker crafts a malicious payload containing path traversal sequences (e.g., '../') intended to point toward critical system or configuration files that the Kibana service typically handles during administrative operations.\nWhen an administrator performs a standard, legitimate operation within the Fleet interface, the underlying backend logic consumes the tainted input previously stored by the attacker. Because the input was not validated, the system resolves the malicious path instead of the intended resource path.\nConsequently, the administrative action, which may involve file deletion or modification, is redirected to the unintended internal target. This allows the attacker to achieve an unauthorized deletion of privileged resources, such as user accounts, authentication tokens, or core organizational assets, effectively weaponizing legitimate administrative workflows to perform malicious actions.\nThe vulnerability does not necessarily require the attacker to have direct administrative access; rather, it exploits the trust placed in the inputs processed during administrative workflows. The impact is severe as the file system operations are performed with the service account permissions of the Kibana application. Post-exploitation, the attacker may achieve persistent disruption or effectively neutralize administrative controls by deleting critical system assets, leading to a compromise of the overall Kibana environment and its associated data stores."
}