{"id":"CVE-2022-31176","aliases":["ALPINE-CVE-2022-31176","BIT-grafana-image-renderer-2022-31176","EUVD-2022-52777","GHSA-2cfh-233g-m4c5"],"status":"published","title":"Grafana Image Renderer leaking files","description":"Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels \u0026 dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01138,"percentile":0.66852,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-306"],"published":"2022-09-02T00:00:00Z","modified":"2026-11-03T07:31:25Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"grafana","fixed_in":["8.5.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["9.1.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana-image-renderer","fixed_in":["3.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana-image-renderer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}]}],"products":[{"vendor":"grafana","product":"grafana-image-renderer"}],"references":[{"url":"https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5","tags":["x_transferred","Mitigation","Third Party Advisory","advisory"]},{"url":"https://github.com/grafana/grafana-image-renderer/pull/364","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20221209-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-31176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31176","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31176.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-31176","title":"Grafana Image Renderer leaking files","description":"Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels \u0026 dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).","status":"published","published":"2022-09-02T00:00:00Z","modified":"2025-04-23T17:32:35.024Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-52777","description":"Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels \u0026 dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).","status":"published","published":"2022-09-02T00:00:00Z","modified":"2025-04-23T17:32:35Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:10.363195Z"}],"nvd":[{"id":"CVE-2022-31176","description":"Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels \u0026 dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).","status":"published","published":"2022-09-02T21:15:16.237Z","modified":"2026-06-17T04:44:57.88Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-200","CWE-306"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"ALPINE-CVE-2022-31176","description":"Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels \u0026 dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).","status":"published","published":"2022-09-02T21:15:16.237Z","modified":"2026-11-03T07:31:25.779024344Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-31176","title":"Grafana Image Renderer leaking files","description":"Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels \u0026 dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).","status":"published","published":"2022-09-02T00:00:00Z","modified":"2026-10-28T02:30:33.761705031Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"BIT-grafana-image-renderer-2022-31176","title":"Grafana Image Renderer leaking files","description":"Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels \u0026 dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).","status":"published","published":"2024-03-06T10:52:34.878Z","modified":"2026-09-08T08:47:49.924509668Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}