CVE-2025-11539: Arbitrary Code Execution in Grafana Image Renderer Plugin
Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.
Instances are vulnerable if:
1. The default token ("authToken") is not changed, or is known to the attacker. 2. The attacker can reach the image renderer endpoint. This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11539?
CVE-2025-11539 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-11539?
To fix CVE-2025-11539, upgrade to Grafana Image Renderer version 4.0.17 or later.
Who is affected by CVE-2025-11539?
CVE-2025-11539 affects all versions of Grafana Image Renderer from 1.0.0 to 4.0.16.
What type of attack is enabled by CVE-2025-11539?
CVE-2025-11539 enables attackers to perform arbitrary file writes, which can lead to remote code execution.
What is the primary cause of CVE-2025-11539?
The primary cause of CVE-2025-11539 is the lack of validation on the filePath parameter in the /render/csv endpoint.