PT-2025-36525 · Volkov+1 · Business Links Panel For Grafana+1

Kazeruch · Published 2025-09-08 · Updated 2025-09-11 · CVE-2025-58746

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Volkov Labs Business Links panel for Grafana versions prior to 2.4.0

Description: The Volkov Labs Business Links panel for Grafana allows navigation using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary administrative actions. This is possible due to arbitrary JavaScript code injection in the URL field within the [Layout] → [Link] → [URL] configuration.

Recommendations: Update to version 2.4.0 or later.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-83

CWE-79

Related Identifiers

CVE-2025-58746

GHSA-93QJ-GV4P-MF53

Affected Products

Business Links Panel For Grafana

Grafana

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58746.json · Exploit
• 🔥 https://github.com/VolkovLabs/business-links/security/advisories/GHSA-93qj-gv4p-mf53 · Exploit
• https://osv.dev/vulnerability/CVE-2025-58746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58746 · Security Note
• https://github.com/VolkovLabs/business-links/commit/9d203a6950de7860e11b25e4265ed8fe60082d7d · Note
• https://t.me/CVEtracker/32004 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1nda3lt/top_10_trending_cves_10092025 · Reddit Post
• https://twitter.com/CVEnew/status/1965186668585169294 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965241338288365574 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1ne4sg2/top_10_trending_cves_11092025 · Reddit Post