CVE-2025-11539 Arbitrary Code Execution in Grafana Image Renderer Plugin
Attackers can execute arbitrary code by writing malicious files via the CSV endpoint if the default authentication token is unchanged.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11539?
CVE-2025-11539 is a critical code injection vulnerability in grafana-image-renderer, published on 9 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.
Instances are vulnerable if:
1. The default token ("authToken") is not changed, or is known to the attacker. 2. The attacker can reach the image renderer endpoint. This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.
Weakness: CWE-94
Which versions are affected by CVE-2025-11539?
1 open source package ship an affected version, including grafana-image-renderer.
| Package | Affected | Fixed in |
|---|---|---|
grafana-image-renderer Bitnami | From 1.0.0 | 4.0.17 |
How do I fix CVE-2025-11539?
Upgrade grafana-image-renderer to 4.0.17 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-11539 being exploited?
There is no known exploitation of CVE-2025-11539 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-image-renderer-2025-11539.