Grafana Image Renderer CVE-2025-11539

Two concrete prerequisites per the advisory: (1) the default image renderer token ('authToken') has not been changed from its default or is otherwise known to the attacker, and (2) the attacker can network-reach the image renderer endpoint (specifically /render/csv). Exploitation targets the filePath parameter of the /render/csv endpoint to write a shared object that the bundled Chromium process then loads. Limiting factors: deployments that rotated 'authToken' to a secret value and restricted network access to the renderer (it is typically an internal service) substantially reduce exposure; only versions 1.0.0 through 4.0.16 are affected, and v4.0.17 remediates the path-traversal validation.

Signals are mixed. The CVSS base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network-reachable, low-complexity RCE with a scope change and full CIA impact - technically severe. However, EPSS is low at 0.64% (49th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, so this is 'no public exploit identified at time of analysis.' Per CVSS the attack is authenticated (PR:L), and the description clarifies that the 'authentication' is a shared 'authToken' that is only meaningful if it has been changed from its default - making the practical barrier much weaker than PR:L implies when operators run the default token. The realistic priority is high for any deployment exposing the image renderer with an unchanged/known token, but lower where the token has been rotated and the endpoint is network-isolated. The vendor (security@grafana.com) reported it and shipped a fix in v4.0.17, which independently corroborates the file-write/path-traversal root cause. No conflicting data on the vulnerability mechanics; the main nuance is that the low EPSS and absence of KEV suggest no widespread exploitation yet despite the critical score.

An attacker who can reach the Grafana Image Renderer endpoint and possesses or guesses the default 'authToken' sends a crafted request to /render/csv with a malicious filePath, writing a shared object to an attacker-chosen location. The Chromium process subsequently loads that shared object, executing the attacker's code on the host. No public exploit was identified at time of analysis, and no user interaction is required (UI:N).