# Kibana 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-28) **URL:** \ **Category:** Security Announcements\ **Created:** [December 15, 2025, 10:15am UTC](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064 "2025-12-15T10:15:09Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Post date:** [December 15, 2025, 10:15am UTC](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064/1 "2025-12-15T10:15:09Z")
**Kibana Cross-site Scripting via the Integration Package Upload Functionality (ESA-2025-28)** Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render an HTML page within a user’s browser via the integration package upload functionality. This issue is related to [ESA-2025-17](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451) (CVE-2025-25018) bypassing that fix to achieve HTML injection. **Affected Versions:** - 7.x: All versions - 8.x: All versions from 8.0.0 up to and including 8.19.7 - 9.x: - All versions from 9.0.0 up to and including 9.1.7 - All versions from 9.2.0 up to and including 9.2.1 **Affected Configurations:** A malicious user would need to have a role that includes All permissions under Management for Fleet and Integrations. **Solutions and Mitigations:** The issue is resolved in version 8.19.8, 9.1.8, and 9.2.2. **For Users that Cannot Upgrade:** There are no workarounds **Severity:** CVSSv3.1: 5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N **CVE ID** : CVE-2025-37732 --- _[View the full topic](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064)._