CVE-2025-11539
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-94
Control incorrecto de generación de código (Inyección de código)
Fecha de publicación:
09/10/2025
Última modificación:
09/10/2025
Descripción
*** Pendiente de traducción *** Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.<br />
<br />
Instances are vulnerable if:<br />
<br />
1. The default token ("authToken") is not changed, or is known to the attacker.<br />
2. The attacker can reach the image renderer endpoint.<br />
This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.
Impacto
Puntuación base 3.x
9.90
Gravedad 3.x
CRÍTICA