# Grafana XSS vulnerability enables arbitrary code execution

Published: 2026-06-09 · Severity: elevated · Sectors: technology, government-national, financial-services, healthcare
Canonical: https://vorant.io/reports/a76e96ac-99cc-5248-8373-af827ab5a47e/grafana-xss-vulnerability-enables-arbitrary-code-execution

> Cross-site scripting flaw in Grafana versions before 10.4.19 allows account takeover and malicious plugin execution without elevated privileges.

A cross-site scripting vulnerability in Grafana (CVE-2025-4123) combines client path traversal with open redirect to inject arbitrary JavaScript and execute malicious frontend plugins. The vulnerability requires no editor permissions and works even with anonymous access enabled. Successful exploitation allows attackers to take over user accounts and run arbitrary code without needing elevated privileges. OX Security researchers demonstrated the vulnerability is easily weaponizable with a working exploit. If the Grafana Image Renderer plugin is installed, the open redirect can be chained to achieve a full read SSRF. Locally running Grafana instances are also vulnerable when attackers craft payloads using the local domain and port.

## Mentioned in this report

- Vulnerabilities: CVE-2025-4123 (templated)

## Detection guidance (public sample)

### Grafana Plugin Path Traversal via Encoded Dot-Dot Sequences (CVE-2025-4123)

ATT&CK: T1190

Web request to Grafana /public/plugins/ containing dot-dot traversal sequences, the client path traversal primitive used to load attacker-controlled frontend plugin content. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Grafana Plugin Path Traversal via Encoded Dot-Dot Sequences (CVE-2025-4123)
status: experimental
description: Detects requests to the Grafana /public/plugins/ static route that contain
  plain or encoded dot-dot traversal sequences. This is the client path traversal
  primitive in CVE-2025-4123, which is chained with an open redirect to load attacker-controlled
  frontend plugin JavaScript. Matches the technique pattern and not any specific payload
  host.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_route:
    cs-uri-stem|contains: /public/plugins/
  selection_traversal:
    cs-uri-stem|contains:
    - ..%2f
    - ..%5c
    - '%2e%2e%2f'
    - '%2e%2e/'
    - '%2e%2e%5c'
    - ../
    - ..\
  condition: selection_route and selection_traversal
falsepositives:
- Vulnerability scanners run by the security team against Grafana
- Misconfigured reverse proxies that rewrite plugin asset paths
level: high
id: 11c1f3f2-d5e5-5b33-9dcd-6176d30aa651
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-grafana-could-allow-for-arbitrary-code-execution_2025-058
```

### Proxy Request to Grafana Plugin Route with Traversal Sequences

ATT&CK: T1204.001

Proxy-observed user request to a Grafana /public/plugins/ URL containing traversal sequences, indicating a crafted link that triggers the XSS and open-redirect chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Proxy Request to Grafana Plugin Route with Traversal Sequences
status: experimental
description: Detects proxy-logged requests, typically from a user following a crafted
  link, to Grafana /public/plugins/ paths containing plain or encoded traversal sequences.
  This is consistent with delivery of the CVE-2025-4123 XSS and open redirect chain
  against users, including anonymous-access instances.
tags:
- attack.execution
- attack.t1204.001
- attack.t1190
logsource:
  category: proxy
detection:
  selection_route:
    c-uri|contains: /public/plugins/
  selection_traversal:
    c-uri|contains:
    - ..%2f
    - ..%5c
    - '%2e%2e%2f'
    - '%2e%2e%5c'
    - ../
  condition: selection_route and selection_traversal
falsepositives:
- Security scanning or penetration testing traffic aimed at internal Grafana instances
- Custom Grafana plugins whose build tooling emits relative asset paths
level: medium
id: 4fc1c208-7a0d-561d-a647-56a1c6268fa6
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-grafana-could-allow-for-arbitrary-code-execution_2025-058
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-grafana-could-allow-for-arbitrary-code-execution_2025-058

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a76e96ac-99cc-5248-8373-af827ab5a47e/grafana-xss-vulnerability-enables-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup