An attacker may supply specially crafted input that Kibana writes to its log files without neutralizing terminal control sequences. When these log entries are viewed in a terminal that processes the escape codes, the displayed data can be altered, hidden, or even fabricated, thereby compromising the integrity of audit trails. The weakness corresponds to CWE‑117, improper output neutralization, and can lead to the kinds of tampering and forging described in CAPEC‑93.

All deployments of Elastic Kibana that write user‑supplied data to logs without proper neutralization, regardless of specific patch level, are susceptible. The vulnerability does not reference a particular version, implying that any instance in which unsanitized input flows to the log subsystem is at risk.

The CVSS score of 8.0 classifies the issue as high severity, meaning that an exploitation could materially degrade security monitoring. The EPSS score of less than 1% indicates that widespread real‑world exploitation is unlikely at present, and the flaw is not listed in the CISA KEV catalog. Attacks would require the ability to inject content that reaches Kibana’s logging code; once such content appears in logs, an end‑user or administrator viewing the logs in a capable terminal can observe tampered data.