Introduction
Attackers can achieve remote code execution on vulnerable Grafana deployments by exploiting a flaw in how the Image Renderer plugin handles files. The plugin is a core component for dashboard rendering and alerting in many enterprise environments, so fast remediation is essential.
Grafana is a leading open source platform for data visualization and monitoring, with millions of users and a broad ecosystem of plugins and integrations. The Image Renderer plugin renders dashboards and panels as images for alerting, reporting, and PDF export. Because the plugin is widely deployed and tied into critical monitoring workflows, a security flaw in it has an outsized impact.
Technical information
CVE-2025-11539 comes from improper validation of the filePath parameter in the /render/csv endpoint of the Grafana Image Renderer plugin. The endpoint accepts a file path where it temporarily stores rendered output. Because that path is not validated or sanitized, an attacker can supply any path they want, including one outside the intended directory structure.
A remote attacker can use this to write a malicious shared object (.so file) to a location on disk that the Chromium process used for rendering will load. When Chromium starts, it loads shared objects from predictable locations. If an attacker places a crafted shared object in one of those locations, they can execute arbitrary code with the privileges of the rendering service.
Exploitation requires:
- The default authentication token (
authToken) is unchanged or known to the attacker - The attacker has network access to the image renderer endpoint
Every deployment of grafana-image-renderer from version 1.0.0 through 4.0.16 is affected. The flaw is categorized under CWE-94 (Code Injection).
Patch information
The development team has released version 3.0.1 to fix the arbitrary code execution vulnerability in the Grafana Image Renderer plugin. The update includes a critical fix that adds stricter input validation and sanitization. Once all incoming data is validated and sanitized, the risk of malicious code execution is mitigated. Users are strongly advised to upgrade to this latest version to protect their systems against exploitation.
Patch source: https://grafana.com/security/security-advisories/cve-2025-11539/
Affected systems and versions
- Product: Grafana Image Renderer plugin
- Affected versions: 1.0.0 through 4.0.16
- Vulnerable configurations: Instances where the default authToken is unchanged or known, and the image renderer endpoint is network-accessible
Vendor security history
Grafana Labs has fixed critical vulnerabilities in the Image Renderer plugin before, including issues with Chromium and dependency management. The vendor typically releases security patches within days of disclosure and runs a public security advisory process. Grafana's history includes multiple advisories for remote code execution and dependency vulnerabilities, which reflects how complex it is to keep rendering capabilities secure.
