Skip to content
OpenAdvisories
High · 7.6 CVE-2025-6023 BIT-grafana-2025-6023EUVD-2025-21861GHSA-vqph-p5vc-g644GO-2025-3817

Grafana is vulnerable to XSS attacks through open redirects and path traversal

Published Jul 18, 2025 · Updated Jul 18, 2025 · Assigned by GRAFANA

Vendor: Grafana Product: Grafana Package: github.com/grafana/grafana Package: grafana Category: Web / CMS Ecosystem: Go Ecosystem: Ubuntu

Description

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.

The open redirect can be chained with path traversal vulnerabilities to achieve XSS.

Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

Affected products

VendorProductAffectedFixed
Grafana Grafana 12.0.x – < 12.0.2+security-01, 11.6.x – < 11.6.3+security-01, 11.5.x – < 11.5.6+security-01, 11.4.x – < 11.4.6+security-01, 11.3.x – < 11.3.8+security-01 12.0.2+security-01

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 grafana 11.5.10-150200.3.80.1 SUSE-SU-2025:4482-1
SLES 15 SP6 grafana 11.5.10-150200.3.80.1 SUSE-SU-2025:4482-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Multi Linux Manager Tools SLE-Micro-5 dracut-saltboot 1.0.0-150002.3.3.1 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.1.20-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 dracut-saltboot 1.0.0-150002.3.3.1 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-alertmanager 0.28.1-150002.4.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.5.7-150002.4.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 mgr-push 5.1.4-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 python-defusedxml 0.7.1-150002.1.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 rhnlib 5.1.3-150002.3.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.1.11-150002.3.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 spacewalk-client-tools 5.1.7-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-susemanager-client 5.1.4-150002.3.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.1.20-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-12 Multi-Linux-ManagerTools-SLE-release 12-120002.1.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 golang-github-prometheus-alertmanager 0.28.1-120002.4.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 grafana 11.5.7-120002.4.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 mgr-push 5.1.4-120002.3.3.3 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 python-defusedxml 0.6.0-120002.1.3.1 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 rhnlib 5.1.3-120002.3.3.1 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 spacecmd 5.1.11-120002.3.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 spacewalk-client-tools 5.1.7-120002.3.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 supportutils-plugin-susemanager-client 5.1.4-120002.3.3.1 SUSE-SU-2025:3817-1
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 1.0.0-150000.1.62.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-tools 0.1.37-150000.1.27.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 15 dracut-saltboot 1.0.0-150000.1.62.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 15 grafana 11.5.10-150000.1.87.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 15 mgr-push 5.0.3-150000.1.30.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 15 rhnlib 5.0.6-150000.3.49.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 15 spacecmd 5.0.14-150000.3.139.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.5-150000.3.30.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 15 uyuni-tools 0.1.37-150000.1.27.1 SUSE-SU-2025:4458-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.28.1-1.34.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 grafana 11.5.10-1.87.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 mgr-push 5.0.3-1.30.3 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 rhnlib 5.0.6-21.55.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 spacecmd 5.0.14-38.162.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.5-6.36.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 uyuni-tools 0.1.37-1.27.1 SUSE-SU-2025:4457-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250730T213748-1.1 openSUSE-SU-2025:15405-1
openSUSE Tumbleweed grafana 11.6.3+security01-1.1 openSUSE-SU-2025:15372-1
openSUSE Leap 15.6 dracut-saltboot 1.0.0-150000.1.62.1 SUSE-SU-2025:4458-1
openSUSE Leap 15.6 grafana 11.5.10-150200.3.80.1 SUSE-SU-2025:4482-1
openSUSE Leap 15.6 spacecmd 5.0.14-150000.3.139.1 SUSE-SU-2025:4458-1
openSUSE Leap 15.6 supportutils-plugin-susemanager-client 5.0.5-150000.3.30.1 SUSE-SU-2025:4458-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana < 1.9.2-0.20250521205822-0ba0b99665a9 1.9.2-0.20250521205822-0ba0b99665a9 GHSA-vqph-p5vc-g644
Go github.com/grafana/grafana all versions — GO-2025-3817

Advisories 9

References