9.1 Critical

CVE-2025-37729 Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a…

Description

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.

Affected products and versions

Product	Affected versions	Fixed in
Elastic Cloud Enterprise (ECE) 4.0	4.0.0 → 4.0.1	No fix stated
Elastic Cloud Enterprise (ECE) 2.5	2.5.0 → 3.8.1	No fix stated

The 3 CVEs of Elastic Cloud Enterprise (ECE) →

CVE-2025-37736 Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can… 8.8 High CVE-2018-3825 In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of… Not rated

Do you use Elastic Cloud Enterprise (ECE)?

Track this CVE Watch Elastic Cloud Enterprise (ECE) Check my SBOMs

www.cveye.io/en/cve/CVE-2025-37729

Timeline

Published October 13, 2025
Last modified February 26, 2026

References

discuss.elastic.co discuss.elastic.co

Track this CVE

CVE-2025-37729 Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a…

Description

Affected products and versions

Other CVEs of Elastic Cloud Enterprise (ECE)