Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana
Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20250521205822-0ba0b99665a9.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-6023US | — | — | ||
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.
The open redir… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-vqph-p5vc-g644ADVISORY
- https://github.com/grafana/grafanaWEB
- https://github.com/grafana/grafana/commit/0ba0b99665a946cd96676ef85ec8bc83028cb1d7FIX
- https://github.com/grafana/grafana/commit/40ed88fe86d347bcde5ddaed6c4a20a95d2f0d55FIX
- https://github.com/grafana/grafana/commit/5b00e21638f565eed46acb4d0b7c009968df4c3bFIX
- https://github.com/grafana/grafana/commit/b6dd2b70c655c61b111b328f1a7dcca6b3954936FIX
- https://github.com/grafana/grafana/commit/e0ba4b480954f8a33aa2cff3229f6bcc05777bd9FIX
- https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan