Patchfirst
Patchfirst
CVE-2025-6023 High · 7.6 EPSS 57.7%

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks

Grafana · Grafana

Summary

An open redirect flaw in Grafana OSS, introduced in version 11.5.0, can be chained with path traversal vulnerabilities to produce cross-site scripting. An attacker can use this to run script in a victim's browser, and exploitation requires that the victim interact with a crafted link, with no authentication needed.

Official description · CVE.org

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

Breakdown
25.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 18 Jul 2025. No public exploit code or confirmed exploitation is recorded.

8 fixes in github.com/grafana/grafana over 12 months. The latest fix listed for github.com/grafana/grafana is 12.2.2.

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 0.0.0-20250521183405-c7a690348df7CVE-2025-412322 May 2025
  2. 0.0.0-20250521183405-c7a690348df7CVE-2025-32602 Jun 2025
  3. 1.9.2-0.20250514160932-04111e9f2afdCVE-2025-341517 Jul 2025
  4. 1.9.2-0.20250521205822-0ba0b99665a9CVE-2025-602318 Jul 2025
  5. 1.9.2-0.20260127141016-e702db6096e0CVE-2026-2172715 Apr 2026
  6. 1.9.2-0.20260323180334-daffe750de85CVE-2026-2172426 Mar 2026
  7. 1.9.2-0.20260513165311-fb7336fc36c1CVE-2026-3338013 May 2026
  8. 12.2.2CVE-2025-4111521 Nov 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/grafana/grafana.

Gogithub.com/grafana/grafanaGHSA-vqph-p5vc-g644GO-2025-3817

Upgrade to 1.9.2-0.20250521205822-0ba0b99665a9

Still affected on this line by CVE-2018-15727 (fixed in 4.6.4+incompatible, a newer line); CVE-2021-39226 (fixed in 7.5.11, a newer line); CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published).

Also affected, despite being newer: All versions.

Gogo get github.com/grafana/grafana@v1.9.2-0.20250521205822-0ba0b99665a9

The first fix for CVE-2025-6023.

Affected versions, by release line

If you runUpgrade to
All versionsNo fix published
All versions before 1.9.2-0.20250521205822-0ba0b99665a91.9.2-0.20250521205822-0ba0b99665a9

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

vendor-advisory 1

grafana.com/security/security-advisories/cve-2025-6023/

release-notes 1

grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/
↑ ↓ chooseEnter openEsc close