Arbitrary Code Execution in Grafana Image Renderer Plugin

Critical
Advisory ID:CVE-2025-11539
Published:2025-10-09
Product:Grafana Image Renderer Plugin
CVSS Score:9.9
CVSS Vector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fixed Versions:
>=4.0.17

Summary

Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.

Instances are vulnerable if:

  1. The default token (authToken) is not changed, or is known to the attacker.
  2. The attacker can reach the image renderer endpoint.

This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.