CVE-2025-4123CWE-601CWE-79

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect

High · published May 22, 2025

Patch now

High probability of exploitation

CVSS calls it high at 7.6. It sits in the 99.9th percentile for exploit probability.

CVSS v3.1
7.6
EPSS
97%
Percentile
99.9
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.97083 · 99.9th percentile
Weaknesses
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-22T07:44Z
EPSS history
Timeline
  • 22 MAY 07:44Z
    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect
    cvelistv5