CVE-2025-4123

Deeper analysis

A cross-site scripting vulnerability exists in Grafana that combines client-side path traversal with an open redirect. Attackers can redirect users to an attacker-controlled site hosting a frontend plugin that executes arbitrary JavaScript in the victim's browser. The issue affects instances where anonymous access is enabled and does not require editor permissions. When the Grafana Image Renderer plugin is also installed, the open redirect can be leveraged for full-read server-side request forgery.

An unauthenticated attacker can exploit the flaw by crafting a malicious link that triggers the redirect and plugin execution, achieving JavaScript execution or SSRF depending on the environment. The default Content-Security-Policy blocks the XSS via its connect-src directive, limiting impact in standard configurations.

Grafana's security advisory and accompanying blog post detail the issue and recommend applying the fixes released in the May 2025 security update. Administrators should verify plugin installations and review anonymous access settings as part of mitigation.

The EPSS score rose from a low baseline to a peak of 0.2295 on 2026-03-01 before receding to 0.0689, indicating emerging exploitation interest after disclosure. Public exploit code is available on Exploit-DB.