CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-72677

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

Score
7.3 high
Published
2026-08-13
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana93kibana939.3.8fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.17</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.17</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Relative Path Traversal (CWE-23) in Kibana can lead to the
	unauthorized deletion of Kibana resources via Relative Path Traversal
	(CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a
	Fleet Server host configuration without rejecting relative traversal
	sequences. The identifier is stored as provided and is later
	incorporated into the request that Kibana issues when that
	configuration is removed.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72677</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72677</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>