CVE-2025-55104: Esri Portal For ArcGIS Stored XSS Vulnerability

CVE-2025-55104 Overview

CVE-2025-55104 is a stored cross-site scripting (XSS) vulnerability affecting Esri ArcGIS Hub and ArcGIS Enterprise Sites. An authenticated user with permission to create or edit a site can inject and persist a JavaScript payload within site content. When another user renders the affected site, the stored payload executes in their browser under the site's origin.

The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploitation requires elevated privileges and victim interaction, which constrains impact but does not eliminate risk in multi-tenant deployments where site authors and site viewers hold different trust levels.

Critical Impact
Attackers who already hold site-editing rights can persist JavaScript that runs in the browsers of authenticated ArcGIS users, enabling session theft, credential harvesting, and actions performed on behalf of the victim.

Affected Products

Esri ArcGIS Hub
Esri ArcGIS Enterprise Sites
Esri Portal for ArcGIS (esri:portal_for_arcgis)

Discovery Timeline

2025-08-21 - CVE-2025-55104 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55104

Vulnerability Analysis

The vulnerability resides in the site creation and editing workflow within ArcGIS Hub and ArcGIS Enterprise Sites. User-supplied content submitted through site fields is stored server-side and later rendered to other users without sufficient neutralization of HTML or JavaScript constructs. When a viewer loads the tampered site, the browser interprets the injected markup as executable script rather than inert text.

Because the payload is persistent, every visitor to the affected site becomes a target until an administrator removes the malicious content. The scope is marked as changed, meaning script execution can affect resources beyond the vulnerable component's original security context, such as parent portal pages that trust the site origin.

Successful exploitation gives the attacker the ability to run arbitrary JavaScript in the victim's authenticated session. Typical outcomes include stealing session tokens, exfiltrating ArcGIS content the victim can access, submitting requests to the ArcGIS REST API on the victim's behalf, and staging follow-on phishing pages within a trusted domain.

Root Cause

The root cause is improper output encoding of stored site fields ([CWE-79]). Site content authored through the Hub or Sites editor is written back into rendered HTML without contextual escaping, allowing <script> tags, event handlers such as onerror, or javascript: URIs to survive into the DOM of viewers.

Attack Vector

The attack is network-reachable and requires an authenticated account with the site create or edit privilege. The attacker crafts a site containing an XSS payload, saves it, and then relies on any user with access to the site to trigger execution. Because the workflow is a legitimate feature, the malicious activity blends with normal editorial behavior and is difficult to distinguish without content inspection.

No public proof-of-concept exploit or entry in the CISA Known Exploited Vulnerabilities catalog is associated with this CVE at the time of publication. The vulnerability is described in prose only; refer to the Esri ArcGIS Trust advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-55104

Indicators of Compromise

Site records containing <script>, onerror=, onload=, javascript:, or base64-encoded HTML in title, description, layout, or custom card fields.
Outbound requests from ArcGIS user browsers to unfamiliar domains shortly after loading a Hub or Enterprise Site page.
Unexpected edits to site content by accounts that do not routinely author sites.
ArcGIS REST API calls originating from user sessions immediately following a site page visit.

Detection Strategies

Scan the ArcGIS content store for site items whose fields contain HTML or JavaScript tokens that should not appear in curated marketing copy.
Correlate site create and edit events with the identity, role, and historical behavior of the editing account to surface anomalous authoring.
Deploy Content Security Policy (CSP) reporting to capture script-src violations that indicate injected inline scripts executing in viewer browsers.

Monitoring Recommendations

Enable and forward ArcGIS Portal audit logs to a central SIEM and alert on site item modifications outside change windows.
Monitor authentication events for session reuse from unexpected geographies following visits to Hub sites.
Track browser telemetry from managed endpoints for JavaScript errors and CSP violations tied to ArcGIS domains.

How to Mitigate CVE-2025-55104

Immediate Actions Required

Apply the mitigations described in the Esri ArcGIS Trust advisory as soon as they are available for your deployment model.
Audit all existing ArcGIS Hub and Enterprise Sites for stored HTML or JavaScript payloads and sanitize or remove affected items.
Review the roster of accounts that hold site create or edit privileges and revoke access that is no longer required.
Rotate session tokens and API keys for any user who accessed a suspected malicious site.

Patch Information

Esri publishes remediation guidance through the ArcGIS Trust Center. Consult the Esri ArcGIS Trust advisory for the fixed versions of ArcGIS Hub, ArcGIS Enterprise Sites, and Portal for ArcGIS that apply to your environment, and follow the vendor upgrade path.

Workarounds

Restrict the site create and edit privileges to a minimum set of trusted publishers until patches are deployed.
Enforce a strict Content Security Policy on the Portal and Hub domains to block inline scripts and unauthorized script sources.
Require multi-factor authentication for all accounts with content authoring roles to reduce the risk of account takeover being used to plant XSS payloads.

bash

# Example: enumerate ArcGIS Portal site items for manual review
curl -s "https://portal.example.com/sharing/rest/search?q=type:%22Hub+Site+Application%22&f=json&token=$TOKEN" \
  | jq '.results[] | {id, title, owner, modified}'