# Question related to ESA-2025-02 (security advisory) **URL:** \ **Category:** Elastic Security\ **Created:** [April 15, 2025, 8:55am UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-02-security-advisory/377141 "2025-04-15T08:55:33Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Stepf](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@Stepf](https://discuss.elastic.co/u/Stepf)\ **Post date:** [April 15, 2025, 8:55am UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-02-security-advisory/377141/1 "2025-04-15T08:55:33Z")
Hello, [Kibana 8.16.4 and 8.17.2 Security Update (ESA-2025-02)](https://discuss.elastic.co/t/kibana-8-16-4-and-8-17-2-security-update-esa-2025-02/376918) is a security advisory against Prototype Pollution in Kibana, which can lead to code injection via unrestricted file upload combined with path traversal. I have a question regarding the Solutions and Mitigations section. It said that to correct this vulnerability, we should upgrade to version 8.16.4 and 8.17.2 or higher. But 8.16.4 is mentioned in the affected Versions section. "Kibana version 8.16.1 up to and including 8.17.1" @ismisepaul can you please clarify which versions are vulnerable and what is the fix version to remediate this vulnerability ? ---
**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Post date:** [June 5, 2025, 4:31pm UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-02-security-advisory/377141/2 "2025-06-05T16:31:30Z")
Hi @Stepf, Thanks for flagging this. We've updated the wording to clarify that 8.16.4 is not affected. The affected versions are: 8.16.1 up to and including 8.16.3, and 8.17.0 up to and including 8.17.1 The fixes are in: 8.16.4 and 8.17.2 or higher