CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-78590

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.

Score
7.3 high
Published
2026-09-02
Links
NVD · cve.org

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana93kibana939.3.8fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.18</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Improper Limitation of a Pathname to a Restricted Directory ('Path
	Traversal') (CWE-22) in the Kibana Fleet feature can lead to the
	unauthorized deletion of privileged resources via Path Traversal
	(CAPEC-126). A low-privileged user holding Fleet Settings write access
	could cause a subsequent administrative action to act on unintended
	internal resources, resulting in the deletion of privileged resources
	such as user accounts and other organizational assets. Exploitation
	requires an administrator to interact with the affected Fleet
	interface.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-78590</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-78590</url>
    </references>
    <dates>
      <discovery>2026-09-02</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>