Improper neutralization of special elements in the Kibana Workflow template engine permits code injection, enabling a malicious actor to read any file on the Kibana server and perform server‑side request forgery. The vulnerability stems from insufficient sanitization of user‐supplied template content, a classic example of CWE‑1336. Exploiting it can leak sensitive configuration data, compromise internal services, or expose unintended network resources.

Elastic Kibana version 9.3.0, specifically the Workflows feature, is affected. An authenticated user possessing the workflowsManagement:executeWorkflow privilege is required to trigger the flaw. The reference advisory indicates that upgrade to Kibana 9.3.1 or later mitigates the issue.

The CVSS score of 8.6 classifies this flaw as high impact, capable of affecting confidentiality, integrity, and availability of the Kibana instance. The EPSS probability is listed as <1%, suggesting limited real‑world exploitation risk at the time of analysis. The vulnerability is not registered in CISA’s KEV catalog. Attackers must be authenticated but can be external if credentials are compromised, and the flaw allows arbitrary file reads and SSRF to internal or external targets.