Security Research

CVE-2025-4123 Grafana Full-Read SSRF + Account Takeover: Open Redirect + CSPT + Client-Side Traversal Chain

#Vulnerability Analysis#Code Audit#Web Security
CVE-2025-4123 Grafana Full-Read SSRF + Account Takeover: Open Redirect + CSPT + Client-Side Traversal Chain

Grafana’s staticHandler returns 302 when a directory is missing the trailing / — attackers use \attacker.com/? so FileSystem.Open parses it as a legitimate directory, but http.Redirect outputs it as an external URL; combined with render endpoint and plugin-app explore client-side path traversal, the three-stage chain delivers Account Takeover.

Unlock to view this content.