CVE-2025-57876: Esri Portal For ArcGIS XSS Vulnerability

CVE-2025-57876 Overview

CVE-2025-57876 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Esri Portal for ArcGIS versions 11.4 and below. An authenticated attacker with high privileges can upload a file containing an embedded XSS payload. When another user loads the file, the browser executes arbitrary JavaScript in the victim's session context. Successful exploitation can disclose a privileged token, giving the attacker full control of the Portal. The flaw affects a widely deployed geospatial platform used across government, utilities, and enterprise mapping deployments.

Critical Impact

Successful exploitation can leak a privileged authentication token, enabling full administrative takeover of the ArcGIS Portal instance.

Affected Products

• Esri Portal for ArcGIS 10.9.1 (including Security 2025 Update 1 and Update 2)
• Esri Portal for ArcGIS 11.0, 11.1, 11.2, 11.3 (including prior security updates)
• Esri Portal for ArcGIS 11.4 (including Security 2025 Update 1 and Update 2)

Discovery Timeline

• 2025-09-29 - CVE-2025-57876 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57876

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Portal for ArcGIS web interface. Portal accepts file uploads from authenticated users but fails to sanitize embedded scriptable content before rendering. When another Portal user opens or previews the malicious file, the browser interprets the embedded payload as executable JavaScript. Because the script runs in the victim's authenticated Portal session, it can access session cookies, CSRF tokens, and privileged API endpoints. The advisory notes that a privileged token can be disclosed, which allows the attacker to escalate from a foothold to full Portal control.

Root Cause

The root cause is improper neutralization of input during web page generation. Portal for ArcGIS trusts the contents of uploaded files rather than encoding or stripping active content before serving them back to other users. This aligns with the classic stored XSS pattern described by [CWE-79], where persisted attacker-controlled data is later rendered without contextual output encoding.

Attack Vector

Exploitation requires an authenticated Portal account with high privileges and user interaction from the victim. The attacker uploads a crafted file containing an embedded script, then relies on another user (typically an administrator) to view or preview it. The scope change reflects that code executes in the victim's browser under the Portal origin, crossing the security boundary from the attacker's uploaded resource. No verified public proof-of-concept is available at the time of publication.

See the Esri Portal for ArcGIS Security 2025 Update 3 Patch advisory for vendor technical detail.

Detection Methods for CVE-2025-57876

Indicators of Compromise

• Uploaded Portal items or attachments whose file content contains <script> tags, javascript: URIs, or event-handler attributes such as onerror= and onload=.
• Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after opening a Portal item.
• Portal API calls using a valid administrator token originating from an unusual IP address or user agent.

Detection Strategies

• Inspect Portal web server access logs for POST requests to item upload and update endpoints followed by GET requests from privileged accounts that render the same items.
• Scan uploaded file content in Portal's content directory for HTML and JavaScript patterns that should not appear in typical geospatial payloads such as SVG, KML, or HTML popups.
• Correlate new Portal admin token generation events with recently viewed shared items to identify possible token theft.

Monitoring Recommendations

• Enable Portal for ArcGIS audit logging at the VERBOSE level and forward logs to a centralized SIEM for retention and correlation.
• Monitor administrator session activity, especially token issuance, role changes, and creation of new privileged accounts.
• Alert on browser telemetry showing script execution originating from Portal item preview pages.

How to Mitigate CVE-2025-57876

Immediate Actions Required

• Apply the Esri Portal for ArcGIS Security 2025 Update 3 Patch to all affected deployments.
• Audit accounts holding publisher and administrator roles and remove privileges that are not required.
• Rotate Portal administrator tokens and reset credentials for any account suspected of misuse.
• Review recently uploaded items and attachments for scriptable content and quarantine suspicious files.

Patch Information

Esri has released the Portal for ArcGIS Security 2025 Update 3 Patch, which addresses CVE-2025-57876. Installation instructions and patch downloads are available in the Esri Security Patch Update advisory. Administrators should test the patch in a staging environment before applying to production Portal deployments.

Workarounds

• Restrict file upload permissions to a minimal set of trusted publishers until patching is complete.
• Enforce a strict Content Security Policy at the reverse proxy in front of Portal to limit inline script execution.
• Require administrators to use a dedicated browser profile that does not preview untrusted shared items.

# Example: block inline script execution via reverse proxy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;