CVE-2025-55103: Esri Portal for ArcGIS XSS Vulnerability

CVE-2025-55103 Overview

CVE-2025-55103 is a stored Cross-Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Enterprise Sites. Affected versions span 10.9.1 through 11.4. The flaw allows a remote, authenticated attacker with high privileges to upload a file containing an embedded XSS payload. When another user loads the file, arbitrary JavaScript executes in the victim's browser. Successful exploitation can disclose a privileged token, potentially granting the attacker full control of the Portal. The vulnerability is tracked under CWE-79 and requires user interaction.

Critical Impact

Exploitation can leak a privileged session token and enable full Portal takeover through JavaScript executed in a victim's authenticated session.

Affected Products

• Esri Portal for ArcGIS 10.9.1
• Esri Portal for ArcGIS 11.1 and 11.2
• Esri Portal for ArcGIS 11.4

Discovery Timeline

• 2025-08-21 - CVE-2025-55103 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55103

Vulnerability Analysis

The issue is a stored XSS flaw in the Enterprise Sites component of Esri Portal for ArcGIS. An authenticated attacker with elevated privileges uploads a file containing an embedded script payload. Portal renders the file in a context where the browser interprets the payload as executable JavaScript. The script then runs with the privileges of the victim viewing the resource.

Because the payload executes in the victim's authenticated session, the attacker can exfiltrate session artifacts. The Esri advisory notes that a privileged token may be disclosed. With that token, the attacker can pivot to full administrative control of the Portal instance. The scope change reflected in the CVSS vector indicates the attack can affect components beyond the initially vulnerable one.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied file content within the Enterprise Sites feature. Portal accepts file uploads from privileged users without stripping or neutralizing embedded HTML and JavaScript. When the file is later rendered, the browser processes attacker-controlled markup as trusted Portal content.

Attack Vector

Exploitation requires an authenticated attacker with high privileges on the Portal and a victim who loads the malicious asset. The attacker uploads a crafted file containing an XSS payload through the Sites interface. When an administrator or other privileged user loads the resource, the script fires under the Portal origin. The script can then read tokens accessible to that origin and transmit them to an attacker-controlled endpoint. See the Esri ArcGIS Trust Blog advisory for vendor details.

Detection Methods for CVE-2025-55103

Indicators of Compromise

• Unexpected files uploaded to Enterprise Sites containing <script> tags, event handlers such as onerror or onload, or javascript: URIs.
• Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading a Sites resource.
• Portal audit log entries showing token issuance or administrative API calls from unexpected client IP addresses.

Detection Strategies

• Review Portal file upload logs for content types and payloads that contain HTML or JavaScript embedded in otherwise benign file formats.
• Baseline privileged Portal activity and alert on anomalous administrative API calls following an Enterprise Sites page view.
• Inspect web server and reverse proxy logs for requests to Sites endpoints returning attacker-controlled markup.

Monitoring Recommendations

• Forward Portal access, upload, and audit logs to a centralized SIEM for correlation with endpoint telemetry.
• Monitor privileged accounts for session token reuse from new IP addresses or user agents.
• Track configuration changes to Sites and Portal administrative settings in near real time.

How to Mitigate CVE-2025-55103

Immediate Actions Required

• Apply the security update referenced in the Esri ArcGIS Trust Blog advisory to all affected Portal for ArcGIS deployments.
• Audit high-privilege Portal accounts and revoke unnecessary administrative roles that could be abused to plant a payload.
• Review recent uploads in Enterprise Sites and remove any files containing embedded scripts or suspicious markup.

Patch Information

Esri has published guidance and a fix through the vendor advisory at Esri ArcGIS Trust Blog. Administrators running Portal for ArcGIS versions 10.9.1 through 11.4 should follow the vendor's upgrade or patch guidance for their specific release train.

Workarounds

• Restrict the ability to create or modify Enterprise Sites to a minimal set of vetted accounts protected by multi-factor authentication.
• Enforce a strict Content Security Policy at the reverse proxy to limit inline script execution and unauthorized network egress from Portal pages.
• Require secondary review of file uploads to Sites and reject files containing HTML, JavaScript, or SVG markup where not required.