GitHub Advisoryadvisory · Go

GHSA-vqph-p5vc-g644 Grafana is vulnerable to XSS attacks through open redirects and path traversal

HIGH Published 2025-07-18 Modified 2025-07-20 Official page ↗
Aliases
CVE-2025-6023
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-79
Reviewed
2025-07-20

Affected packages

• Go github.com/grafana/grafana: < 1.9.2-0.20250521205822-0ba0b99665a9 → fixed in 1.9.2-0.20250521205822-0ba0b99665a9

Description

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

Related

Alias · CVE (1)

  • CVE-2025-6023 An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References