CVE-2025-55107: Esri Portal for ArcGIS XSS Vulnerability

CVE-2025-55107 Overview

CVE-2025-55107 is a stored Cross-Site Scripting (XSS) vulnerability affecting Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 through 11.4. A remote, authenticated attacker with high privileges can upload a malicious file containing an embedded XSS payload. When another user loads the file, the payload executes arbitrary JavaScript in the victim's browser. Successful exploitation can disclose a privileged token, enabling full control of the Portal. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Exploitation can leak a privileged authentication token, allowing an attacker to take full administrative control of the affected ArcGIS Portal instance.

Affected Products

• Esri Portal for ArcGIS Enterprise Sites 10.9.1
• Esri Portal for ArcGIS Enterprise Sites 10.9.1 through 11.3
• Esri Portal for ArcGIS Enterprise Sites 11.4

Discovery Timeline

• 2025-08-21 - CVE-2025-55107 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55107

Vulnerability Analysis

The vulnerability resides in the file handling logic of ArcGIS Enterprise Sites, a component of Esri Portal for ArcGIS used to build and publish site pages. The application accepts file uploads without adequately sanitizing embedded script content. When the Portal renders or previews the uploaded file in a browser context, the injected JavaScript executes under the origin of the Portal application.

Because the payload runs in the victim's session, the attacker can access DOM-accessible artifacts, including a privileged access token stored or issued by the Portal. With that token, the attacker can invoke administrative APIs and assume control of the Portal instance. The scope change reflected in the CVSS vector confirms that impact extends beyond the vulnerable component into resources managed by the Portal.

Root Cause

The root cause is improper neutralization of user-supplied content within uploaded files. The Portal does not strip or encode active scripting elements before serving the file to authenticated users, violating output encoding requirements for HTML rendering contexts.

Attack Vector

Exploitation requires an authenticated attacker with high privileges on the Portal, and requires user interaction from a victim who loads the malicious content. The attacker uploads a crafted file through the Enterprise Sites interface, then waits for a privileged user to open it. Once triggered, the script harvests session data and forwards it to attacker-controlled infrastructure. See the Esri ArcGIS Administration Blog for vendor technical details.

Detection Methods for CVE-2025-55107

Indicators of Compromise

• Unexpected file uploads to ArcGIS Enterprise Sites containing HTML, SVG, or JavaScript payloads from non-standard user accounts.
• Outbound HTTP requests from Portal user sessions to unfamiliar external domains shortly after loading a site asset.
• Anomalous use of administrative API tokens originating from IP addresses inconsistent with the token owner's normal activity.

Detection Strategies

• Inspect uploaded site content for <script> tags, event handler attributes, and embedded JavaScript within SVG or HTML files.
• Correlate file upload events in Portal audit logs with subsequent privileged API calls from the same session or token.
• Monitor browser telemetry on administrator workstations for script execution originating from Portal-hosted file paths.

Monitoring Recommendations

• Enable and centralize ArcGIS Portal audit logging, including file upload and content access events.
• Alert on privileged token usage from new user agents, geographic locations, or ASN sources.
• Review Enterprise Sites content authored by high-privilege accounts on a regular cadence.

How to Mitigate CVE-2025-55107

Immediate Actions Required

• Apply the patch or upgrade referenced in the Esri security advisory to a fixed release of Portal for ArcGIS.
• Audit existing Enterprise Sites content for suspicious files uploaded by privileged accounts since deployment.
• Rotate administrative tokens and credentials on Portal instances that may have been exposed.

Patch Information

Esri has published guidance for this vulnerability on the Esri ArcGIS Administration Blog. Administrators running Portal for ArcGIS versions 10.9.1 through 11.4 should follow vendor instructions to apply the appropriate security update or patch bundle for their deployed version.

Workarounds

• Restrict the set of accounts permitted to create or edit Enterprise Sites content until patching is complete.
• Enforce least privilege on Portal roles so that fewer accounts hold the high privileges required for exploitation.
• Apply a Content Security Policy at the reverse proxy or web server layer to constrain inline script execution where feasible.