grafana-image-renderer vulnerabilities

2 known vulnerabilities in grafana-image-renderer from Grafana. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  grafana-image-renderer: Improper Control of Generation of Code

  CVE-2025-11539Oct 9, 2025Grafana

  Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an

• 8.1 High severity

  grafana-image-renderer: Missing Authentication for Critical Functionality

  CVE-2022-31176Sep 2, 2022GrafanaEPSS 1.14%

  Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a mali