High severity7.6NVD Advisory· Published May 22, 2025· Updated Apr 29, 2026
CVE-2025-4123
CVE-2025-4123
Description
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.
The default Content-Security-Policy (CSP) in Grafana will block the XSS though the connect-src directive.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/grafana/grafanaGo | < 0.0.0-20250521183405-c7a690348df7 | 0.0.0-20250521183405-c7a690348df7 |
Affected products
24cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*range: <10.4.18
- cpe:2.3:a:grafana:grafana:10.4.18:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:11.2.9:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:11.3.6:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:11.4.4:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:11.5.4:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:11.6.1:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:12.0.0:-:*:*:*:*:*:*
- osv-coords16 versionspkg:apk/chainguard/grafana-11.0pkg:apk/chainguard/grafana-11.1pkg:apk/chainguard/grafana-11.1-oci-compatpkg:apk/chainguard/grafana-fips-11.6pkg:apk/chainguard/grafana-fips-12.2pkg:apk/chainguard/grafana-fips-12.3pkg:apk/chainguard/grafana-fips-12.4pkg:apk/chainguard/grafana-fips-13.0pkg:apk/chainguard/grafana-oci-compatpkg:bitnami/grafanapkg:golang/github.com/grafana/grafanapkg:rpm/almalinux/grafanapkg:rpm/almalinux/grafana-selinuxpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweedpkg:rpm/suse/release-notes-susemanager&distro=SUSE%20Manager%20Server%204.3
< 11.0.11-r3+ 15 more
- (no CPE)range: < 11.0.11-r3
- (no CPE)range: < 11.1.13-r5
- (no CPE)range: < 11.1.13-r5
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 11.0.11-r3
- (no CPE)range: < 10.4.18
- (no CPE)range: < 0.0.0-20250521183405-c7a690348df7
- (no CPE)range: < 10.2.6-13.el9_6
- (no CPE)range: < 10.2.6-13.el9_6
- (no CPE)range: < 0.0.20250527T204717-1.1
- (no CPE)range: < 11.6.1+security01-1.1
- (no CPE)range: < 4.3.15.2-150400.3.133.1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-q53q-gxq9-mgrjghsaADVISORY
- grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/nvdVendor Advisory
- grafana.com/security/security-advisories/cve-2025-4123/nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2025-4123ghsaADVISORY
- github.com/grafana/grafana/commit/c7a690348df761d41b659224cbc50a46a0c0e4ccghsaWEB
- grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580ghsaWEB
- grafana.com/security/security-advisories/cve-2025-4123ghsaWEB
- pkg.go.dev/vuln/GO-2025-3702ghsaWEB
- www.exploit-db.com/exploits/52491nvdWEB
News mentions
0No linked articles in our index yet.