CVE-2025-11539 Details
Description
Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process. Instances are vulnerable if: 1. The default token ("authToken") is not changed, or is known to the attacker. 2. The attacker can reach the image renderer endpoint. This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.
A remote code execution vulnerability has been identified in the Grafana Image Renderer plugin, versions 1.0.0 prior to 4.0.16. This vulnerability arises from an arbitrary file write issue in the '/render/csv' endpoint, which failed to properly validate the 'filePath' parameter. As a result, an attacker could save a shared object to a location of their choosing, where it would be loaded by the Chromium process. Instances are vulnerable if the default 'authToken' has not been changed or is known to the attacker, and if the attacker can access the image renderer endpoint.
Users can upgrade to Grafana Image Renderer version 4.0.17 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2025CISA-ADP
Assessed Oct 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/grafana/grafana-image-renderer/releases/tag/v4.0.17 | [email protected] | Release NotesVendor |
| https://grafana.com/security/security-advisories/cve-2025-11539/ | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grafana Image Renderer | >= 1.0.0, <= 4.0.16 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2025 | New CVE Received | [email protected] |