CVE-2025-11539
Severity CVSS v4.0:
Pending analysis
Type:
CWE-94
Code Injection
Publication date:
09/10/2025
Last modified:
09/10/2025
Description
Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.<br />
<br />
Instances are vulnerable if:<br />
<br />
1. The default token ("authToken") is not changed, or is known to the attacker.<br />
2. The attacker can reach the image renderer endpoint.<br />
This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.
Impact
Base Score 3.x
9.90
Severity 3.x
CRITICAL