CVE-2026-78599CWE-22path-traversal

CVE-2026-78599

Medium · published September 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-02T19:17Z
Affected products (2)
ProductVersionsFixed in
elastic/kibana≥ 8.0.0, < 8.19.188.19.18
elastic/kibana≥ 9.0.0, < 9.4.39.4.3
References (1)
https://discuss.elastic.co/t/kibana-8-19-18-9-4-3-security-update-esa-2026-157/390112 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:43Z
    Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
    cvelistv5