Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T15:17:41.003Z",
  "pubdate": "2026-09-02T15:17:41.003Z",
  "executiveSummary": "This vulnerability involves an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) within the Kibana Fleet feature, facilitating unauthorized resource manipulation through Path Traversal (CAPEC-126).\nThe vulnerability allows a low-privileged user possessing Fleet write access to manipulate internal path references, which are subsequently processed by an administrative delete operation.\nThe primary risk is the unauthorized deletion of internal resources. Successful exploitation requires a two-stage process: an initial configuration modification by a low-privileged attacker and subsequent interaction with the affected Fleet interface by an administrator.\nThis flaw effectively elevates the impact of a low-privileged account by leveraging the systemic privileges of an administrator to perform destructive actions against unintended resources.\nThe vulnerability impacts the integrity and availability of internal Kibana components by potentially allowing for the deletion of critical configuration or data files.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient validation or sanitization of input paths provided within the Kibana Fleet feature. Specifically, the application fails to adequately restrict user-provided pathnames, allowing them to traverse outside of the intended directory structure.\nThe exploitation flow initiates when a low-privileged user with Fleet write access modifies a configuration or resource definition within the Fleet interface. By injecting path traversal sequences (e.g., ../) into parameters that handle file or resource locations, the attacker crafts a malicious payload that points to sensitive or unintended internal resources on the filesystem.\nThis payload is persisted within the system's metadata or configuration store. The vulnerability is triggered when an administrator subsequently interacts with the Fleet interface to perform a delete operation on the resource previously modified by the attacker.\nBecause the system fails to perform path normalization or validation during the deletion routine, the administrative service resolves the tainted path to the unintended target location. The administrative delete operation then executes, resulting in the unauthorized deletion of the target resource.\nThe exploitation is dependent on the intersection of lower-privileged input persistence and higher-privileged execution. The lack of strict directory jail or filesystem abstraction within the Fleet deletion logic allows this escalation. No network exposure beyond the standard Kibana interface is required, as the vector exists within the application's internal resource management logic.\nPost-exploitation impact is focused on the destruction of resources. If an attacker can successfully target sensitive internal files or configuration data that are writeable by the Kibana service process, the impact could range from system instability to the loss of critical fleet management data, depending on the permissions of the user context under which the Kibana process runs."
}