Arbitrary Code Execution in Grafana Image Renderer Plugin

The impact of CVE-2025-11539 is severe. Successful exploitation allows an attacker to execute arbitrary code on the server hosting the Grafana Image Renderer. This could lead to complete system compromise, data exfiltration, and denial of service. The attacker needs to be able to reach the /render/csv endpoint and bypass authentication, typically by leveraging the default 'authToken' or obtaining valid credentials. The ability to write shared objects and have them loaded by the Chromium process significantly elevates the risk, as it bypasses typical sandboxing protections. This vulnerability shares similarities with other file write vulnerabilities where attackers leverage process loading mechanisms to achieve code execution.

Organizations using Grafana Image Renderer in production environments, particularly those that have not changed the default authentication token or have exposed the Image Renderer endpoint to untrusted networks, are at significant risk. Shared hosting environments where multiple users share the same Grafana instance are also particularly vulnerable.

• linux / server:

find / -name '*.so' -type f -mtime -7 -ls

• generic web:

curl -I <grafana_image_renderer_url>/render/csv

• grafana: Review Grafana Image Renderer logs for unusual file write attempts, particularly to directories outside of the expected data storage location.

1. 2025-10-09Disclosure

   disclosure

1. Réservé2025-10-09
2. Publiée2025-10-09
3. Modifiée2026-02-26
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-11539 is to upgrade Grafana Image Renderer to version 4.0.17 or later. If immediate upgrading is not possible, consider restricting access to the /render/csv endpoint using a web application firewall (WAF) or proxy. Implement strict authentication controls and immediately change the default 'authToken' to a strong, unique value. Monitor Grafana Image Renderer logs for suspicious file write attempts, particularly those targeting unusual locations. While a direct detection signature is difficult to create, monitoring for the creation of shared object files in unexpected directories could be a useful indicator.