Grafana XSS vulnerability enables arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Cross-site scripting flaw in Grafana versions before 10.4.19 allows account takeover and malicious plugin execution without elevated privileges.
A cross-site scripting vulnerability in Grafana (CVE-2025-4123) combines client path traversal with open redirect to inject arbitrary JavaScript and execute malicious frontend plugins. The vulnerability requires no editor permissions and works even with anonymous access enabled. Successful exploitation allows attackers to take over user accounts and run arbitrary code without needing elevated privileges. OX Security researchers demonstrated the vulnerability is easily weaponizable with a working exploit. If the Grafana Image Renderer plugin is installed, the open redirect can be chained to achieve a full read SSRF. Locally running Grafana instances are also vulnerable when attackers craft payloads using the local domain and port.
Mentioned in this report
Detection guidance
Grafana Plugin Path Traversal via Encoded Dot-Dot Sequences (CVE-2025-4123)
Web request to Grafana /public/plugins/ containing dot-dot traversal sequences, the client path traversal primitive used to load attacker-controlled frontend plugin content. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Grafana Plugin Path Traversal via Encoded Dot-Dot Sequences (CVE-2025-4123)
status: experimental
description: Detects requests to the Grafana /public/plugins/ static route that contain
plain or encoded dot-dot traversal sequences. This is the client path traversal
primitive in CVE-2025-4123, which is chained with an open redirect to load attacker-controlled
frontend plugin JavaScript. Matches the technique pattern and not any specific payload
host.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_route:
cs-uri-stem|contains: /public/plugins/
selection_traversal:
cs-uri-stem|contains:
- ..%2f
- ..%5c
- '%2e%2e%2f'
- '%2e%2e/'
- '%2e%2e%5c'
- ../
- ..\
condition: selection_route and selection_traversal
falsepositives:
- Vulnerability scanners run by the security team against Grafana
- Misconfigured reverse proxies that rewrite plugin asset paths
level: high
id: 11c1f3f2-d5e5-5b33-9dcd-6176d30aa651
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-grafana-could-allow-for-arbitrary-code-execution_2025-058
Proxy Request to Grafana Plugin Route with Traversal Sequences
Proxy-observed user request to a Grafana /public/plugins/ URL containing traversal sequences, indicating a crafted link that triggers the XSS and open-redirect chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Proxy Request to Grafana Plugin Route with Traversal Sequences
status: experimental
description: Detects proxy-logged requests, typically from a user following a crafted
link, to Grafana /public/plugins/ paths containing plain or encoded traversal sequences.
This is consistent with delivery of the CVE-2025-4123 XSS and open redirect chain
against users, including anonymous-access instances.
tags:
- attack.execution
- attack.t1204.001
- attack.t1190
logsource:
category: proxy
detection:
selection_route:
c-uri|contains: /public/plugins/
selection_traversal:
c-uri|contains:
- ..%2f
- ..%5c
- '%2e%2e%2f'
- '%2e%2e%5c'
- ../
condition: selection_route and selection_traversal
falsepositives:
- Security scanning or penetration testing traffic aimed at internal Grafana instances
- Custom Grafana plugins whose build tooling emits relative asset paths
level: medium
id: 4fc1c208-7a0d-561d-a647-56a1c6268fa6
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-grafana-could-allow-for-arbitrary-code-execution_2025-058
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-grafana-could-allow-for-arbitrary-code-execution_2025-058
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs