The vulnerability in Elastic Kibana allows a path traversal flaw (CWE‑22) to be exploited by a low‑privileged user with tag‑creation rights. By manipulating the file path used during tag creation, the user can trick a later administrative action into operating on an unintended target. This can result in the deletion of privileged resources, such as administrative accounts and other critical organizational assets. The flaw effectively removes the boundary that should restrict file access to a designated directory, enabling destructive changes.

Elastic Kibana is the affected product. No specific version numbers are listed in the advisory; the issue is tied to the Kibana instance that supports tag management and the path‑validation logic.

The CVSS score of 7.3 indicates a high severity, but the exploitation requires an administrator to open the affected tag‑management interface after the low‑privilege action. The attack thus depends on an interaction step that an admin may or may not perform, reducing the likelihood of uncoordinated exploitation. EPSS data is unavailable and the vulnerability is not currently listed in CISA’s KEV catalog. Nonetheless, the potential to permanently delete privileged resources warrants immediate attention, especially in environments where administrative privileges are broadly distributed.