CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-78592

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged resources including administrative accounts and other organizational assets. Exploitation requires an administrator to interact with the affected interface.

Score
7.3 high
Published
2026-09-01
Links
NVD · cve.org

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana93kibana939.3.8fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.16</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.16</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Improper Limitation of a Pathname to a Restricted Directory ('Path
	Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion
	of privileged resources via Path Traversal (CAPEC-126). A
	low-privileged user holding tag creation privileges could cause a
	subsequent administrative action in the tag management interface to
	act on an unintended target, resulting in the deletion of privileged
	resources including administrative accounts and other organizational
	assets. Exploitation requires an administrator to interact with the
	affected interface.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-78592</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-78592</url>
    </references>
    <dates>
      <discovery>2026-09-01</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>