{"id":"CVE-2025-4123","published":"2025-05-22T07:44:09Z","modified":"2026-04-29T19:56:35Z","title":"A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open…","vendor":"Grafana","product":"Grafana","tier":"core","eol":null,"affectedVersions":[{"vendor":"Grafana","product":"Grafana","versions":[">= 10.4.18+security-01, < 10.4.19",">= 11.2.9+security-01, < 11.2.10",">= 11.3.6+security-01, < 11.3.7",">= 11.4.4+security-01, < 11.4.5",">= 11.5.4+security-01, < 11.5.5",">= 11.6.1+security-01, < 11.6.2",">= 12.0.0+security-01, < 12.0.1"]}],"description":{"text":"A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.","provenance":"source","from":"CVE.org"},"summary":{"text":"A cross-site scripting flaw in Grafana arises from chaining a client-side path traversal with an open redirect, which can send users to an external site hosting a frontend plugin that runs arbitrary JavaScript. An unauthenticated attacker can exploit this by luring a user to a crafted link, with anonymous access enabled sufficing and no editor permissions required, and the default Content-Security-Policy's connect-src directive blocks the attack; if the Grafana Image Renderer plugin is installed, the open redirect can additionally be used for a full-read SSRF.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:53Z"},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.97083,"percentile":0.99892,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-21","exploitedFirstSeen":"2025-07-21","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-21&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-22&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-23&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-24&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-25&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-26&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-27&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-28&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-29&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-30&host_type=src&vulnerability=cve-2025-4123","date":"2025-07-30"}],"evidenceTotal":148,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Well-known Out-of-band Interaction Domains","url":"https://otx.alienvault.com/pulse/699442284d8721685a1c8e4b","created":"2026-02-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"},{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2025-4123/","tags":["vendor-advisory"]},{"url":"https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/","tags":["mitigation","release-notes"]},{"url":"https://www.exploit-db.com/exploits/52491","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<0.0.0-20250521183405-c7a690348df7","all versions"],"patched":["0.0.0-20250521183405-c7a690348df7"],"from":["GHSA-q53q-gxq9-mgrj","GO-2025-3704"],"provenance":"source"}],"advisories":[{"id":"GHSA-q53q-gxq9-mgrj","url":"https://github.com/advisories/GHSA-q53q-gxq9-mgrj","severity":"HIGH","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<0.0.0-20250521183405-c7a690348df7"],"patched":["0.0.0-20250521183405-c7a690348df7"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-16107","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16107","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52491,"url":"https://www.exploit-db.com/exploits/52491","title":"Grafana 11.6.0 - SSRF","type":"webapps","platform":"multiple","date":"2026-04-06","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-04-06"},"pocGithub":{"count":4,"skipped":1,"earliest":"2025-05-22","earliestUrl":"https://github.com/NightBloodZ/CVE-2025-4123","repos":[{"name":"NightBloodZ/CVE-2025-4123","url":"https://github.com/NightBloodZ/CVE-2025-4123","stars":58,"created":"2025-05-22"},{"name":"ynsmroztas/CVE-2025-4123-Exploit-Tool-Grafana-","url":"https://github.com/ynsmroztas/CVE-2025-4123-Exploit-Tool-Grafana-","stars":33,"created":"2025-06-04"},{"name":"ItsNee/Grafana-CVE-2025-4123-POC","url":"https://github.com/ItsNee/Grafana-CVE-2025-4123-POC","stars":0,"created":"2025-09-12"},{"name":"MorphyKutay/CVE-2025-4123-Exploit","url":"https://github.com/MorphyKutay/CVE-2025-4123-Exploit","stars":0,"created":"2025-10-14"}]},"nuclei":[{"id":"CVE-2025-4123","name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","severity":"high","path":"http/cves/2025/CVE-2025-4123.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4123.yaml"}],"first":{"date":"2025-05-22","source":"PoC-in-GitHub","url":"https://github.com/NightBloodZ/CVE-2025-4123"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/52491"],"flow":[],"timeline":[{"date":"2025-05-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-4123","provenance":"source"},{"date":"2025-05-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-04-06","url":"https://github.com/NightBloodZ/CVE-2025-4123","provenance":"source"},{"date":"2025-07-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-21&host_type=src&vulnerability=cve-2025-4123","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 467 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 4 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.32,"detail":"base score 7.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}