CVE-2026-78592: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elastic Kibana

This vulnerability (CWE-22) in Elastic Kibana involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. A low-privileged user who can create tags can manipulate the tag management interface such that when an administrator subsequently interacts with it, privileged resources including administrative accounts and organizational assets may be deleted unintentionally. The attack requires user interaction from an administrator, and the vulnerability impacts specific Kibana versions including 7.11.0, 8.0.0, 9.0.0, and 9.4.0. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and high impact on integrity and availability.

Successful exploitation can lead to unauthorized deletion of privileged resources such as administrative accounts and other organizational assets, causing significant integrity and availability impact. The attack requires a low-privileged user to have tag creation privileges and an administrator to interact with the affected interface, making exploitation dependent on user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should limit tag creation privileges to trusted users and ensure administrators are cautious when interacting with the tag management interface. Monitor for suspicious activity related to tag management and restrict access where possible.