CVE-2025-55106: Esri Portal for ArcGIS Stored XSS Flaw

CVE-2025-55106 Overview

CVE-2025-55106 is a stored Cross-Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Enterprise Sites. It affects versions 10.9.1 through 11.4. An authenticated attacker with high privileges can upload a file containing an embedded script payload. When another user loads the file, the browser executes arbitrary JavaScript in the victim's session context. The vulnerability is tracked as CWE-79 and requires user interaction to trigger. Successful exploitation can disclose a privileged token, giving the attacker full control of the Portal.

Critical Impact
Successful exploitation may leak a privileged authentication token and enable full takeover of the ArcGIS Portal instance.

Affected Products

Esri Portal for ArcGIS Enterprise Sites 10.9.1
Esri Portal for ArcGIS Enterprise Sites 11.0 through 11.3
Esri Portal for ArcGIS Enterprise Sites 11.4

Discovery Timeline

2025-08-21 - CVE-2025-55106 published to the National Vulnerability Database
2026-06-17 - CVE-2025-55106 last updated in NVD

Technical Details for CVE-2025-55106

Vulnerability Analysis

The vulnerability resides in the Enterprise Sites component of Esri Portal for ArcGIS. The application accepts file uploads from authenticated users but fails to sanitize embedded script content before rendering the file to other users. When a victim opens the malicious file through the Portal interface, the browser parses and executes the injected JavaScript. Because the script runs in the victim's session, it can read and exfiltrate the Portal authentication token. Attackers who obtain a token belonging to an administrator can perform any Portal operation, including creating users, altering content, and reconfiguring the site.

Root Cause

The root cause is missing output encoding and input sanitization on file content served by the Enterprise Sites feature. User-supplied data is stored server-side and later reflected into pages without neutralizing HTML or JavaScript, meeting the classic definition of stored XSS under CWE-79.

Attack Vector

Exploitation requires an authenticated account with high privileges on the Portal, and the victim must interact with the malicious content. The attacker first uploads a file with an embedded script payload to a Site accessible to other users. When a victim, ideally one with administrative privileges, navigates to the affected Site, the payload executes and can transmit the session token to an attacker-controlled endpoint. See the Esri Trust ArcGIS Blog Post for vendor confirmation of the attack path.

No public proof-of-concept code is available for this issue. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2025-55106

Indicators of Compromise

Uploaded files in Enterprise Sites containing <script> tags, event handlers such as onerror or onload, or javascript: URIs.
Outbound HTTP requests from Portal user browsers to unfamiliar domains carrying tokens or cookie values in query strings.
Unexpected creation of privileged users or API token generation events in Portal audit logs shortly after a Site page visit.

Detection Strategies

Inspect stored Site content and uploaded files for HTML or JavaScript patterns using server-side scanning.
Correlate Portal audit logs with proxy or DNS telemetry to identify token exfiltration attempts following file uploads.
Enable browser-side Content Security Policy (CSP) violation reporting to catch inline script execution on Portal pages.

Monitoring Recommendations

Monitor uploads by high-privilege accounts to Enterprise Sites and flag files containing script markup for review.
Alert on anomalous administrative actions performed shortly after a session accesses a shared Site page.
Review web server access logs for suspicious Referer chains linking Site content pages to external destinations.

How to Mitigate CVE-2025-55106

Immediate Actions Required

Apply the security update referenced in the Esri Trust ArcGIS Blog Post for Portal for ArcGIS.
Audit accounts with privileges to publish Enterprise Sites content and remove unnecessary high-privilege access.
Review recent uploads to Sites for embedded scripts and remove any suspicious files.

Patch Information

Esri has published guidance and patches for affected versions through the Trust ArcGIS advisory portal. Administrators should upgrade Portal for ArcGIS to a patched release identified in the vendor advisory and confirm the fix by validating the Portal version after upgrade.

Workarounds

Restrict Enterprise Sites publishing rights to a small set of trusted administrators until patching is complete.
Deploy a Content Security Policy that blocks inline scripts and restricts script sources on Portal domains.
Route Portal traffic through a Web Application Firewall that inspects uploaded file content for script payloads.

bash

# Example Content-Security-Policy header for reverse proxy fronting Portal
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;