{"id":"CVE-2025-11539","aliases":["BIT-grafana-image-renderer-2025-11539","EUVD-2025-33321"],"status":"published","title":"Arbitrary Code Execution in Grafana Image Renderer Plugin","description":"Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.\n\nInstances are vulnerable if:\n\n1. The default token (\"authToken\") is not changed, or is known to the attacker.\n2. The attacker can reach the image renderer endpoint.\nThis issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00651,"percentile":0.51543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2025-10-09T07:18:15Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Bitnami","package":"grafana-image-renderer","fixed_in":["4.0.17"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"grafana-image-renderer","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"4.0.17"}]}]}],"products":[{"vendor":"grafana","product":"grafana-image-renderer"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2025-11539/","tags":["vendor-advisory","web","advisory"]},{"url":"https://github.com/grafana/grafana-image-renderer/releases/tag/v4.0.17","tags":["patch","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11539","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11539.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-11539","title":"Arbitrary Code Execution in Grafana Image Renderer Plugin","description":"Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.\n\nInstances are vulnerable if:\n\n1. The default token (\"authToken\") is not changed, or is known to the attacker.\n2. The attacker can reach the image renderer endpoint.\nThis issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.","status":"published","published":"2025-10-09T07:18:15.819Z","modified":"2026-02-26T17:47:59.419Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:50.520421Z"}],"euvd":[{"id":"EUVD-2025-33321","description":"Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.\n\nInstances are vulnerable if:\n\n1. The default token (\"authToken\") is not changed, or is known to the attacker.\n2. The attacker can reach the image renderer endpoint.\nThis issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.","status":"published","published":"2025-10-09T07:18:15Z","modified":"2026-02-26T17:47:59Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:22.388505Z"}],"nvd":[{"id":"CVE-2025-11539","description":"Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.\n\nInstances are vulnerable if:\n\n1. The default token (\"authToken\") is not changed, or is known to the attacker.\n2. The attacker can reach the image renderer endpoint.\nThis issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.","status":"published","published":"2025-10-09T08:15:38.813Z","modified":"2026-10-08T13:10:00.2Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:11:35.93863Z"}],"osv":[{"id":"CVE-2025-11539","title":"Arbitrary Code Execution in Grafana Image Renderer Plugin","description":"Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.\n\nInstances are vulnerable if:\n\n1. The default token (\"authToken\") is not changed, or is known to the attacker.\n2. The attacker can reach the image renderer endpoint.\nThis issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.","status":"published","published":"2025-10-09T07:18:15.819Z","modified":"2026-10-28T02:31:00.950051759Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"BIT-grafana-image-renderer-2025-11539","title":"Arbitrary Code Execution in Grafana Image Renderer Plugin","description":"Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.\n\nInstances are vulnerable if:\n\n1. The default token (\"authToken\") is not changed, or is known to the attacker.\n2. The attacker can reach the image renderer endpoint.\nThis issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.","status":"published","published":"2025-10-11T08:40:19.61Z","modified":"2025-10-11T09:28:18.117662Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}