-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided commits clearly indicates that the vulnerability lies within the staticHandler function in pkg/api/static/static.go. All the provided security patches modify this single function to address the same issue. The core of the vulnerability is the lack of input sanitization for the URL path, which is taken directly from the user's request. This allows an attacker to craft a URL that, when processed by Grafana, results in a redirect to a malicious domain. The fix, which is consistently applied across all patches, is the introduction of the path.Clean() function. This function call effectively neutralizes the path traversal and open redirect vulnerability by cleaning the user-provided path before it is used to construct the redirect URL. The new test file pkg/api/static/static_test.go also confirms this by adding a test case for path cleanup.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | < 1.9.2-0.20250521205822-0ba0b99665a9 | 1.9.2-0.20250521205822-0ba0b99665a9 |