PT-2025-41359 · Grafana · Grafana-Image-Renderer
Callum Carney
·
Published
2025-10-09
·
Updated
2025-11-26
·
CVE-2025-11539
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Grafana Image Renderer versions 1.0.0 through 4.0.16
Description
Grafana Image Renderer is susceptible to remote code execution due to an arbitrary file write issue. The
/render/csv API endpoint lacks proper validation of the filePath parameter, allowing an attacker to save a shared object to an arbitrary location. This saved object is then loaded by the Chromium process. Successful exploitation requires either the default token (authToken) to be unchanged or known to the attacker, and the attacker must be able to reach the image renderer endpoint.Recommendations
Versions 1.0.0 through 4.0.16 should be updated.
Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grafana-Image-Renderer