CVE-2025-58746

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-58746
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58746.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-58746
Aliases
  • GHSA-93qj-gv4p-mf53
Published
2025-09-08T22:44:04Z
Modified
2026-10-28T02:30:33Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Volkov Labs Business Links plugin vulnerable to privilege escalation attack
Details

The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary administrative actions. This is possible because the plugin allows arbitrary JavaScript code injection in the [Layout] → [Link] → [URL] field. Version 2.4.0 contains a fix for the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-83"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58746.json"
}
References

Affected packages

Git / github.com/volkovlabs/business-links

Affected ranges

Type
GIT
Repo
https://github.com/volkovlabs/business-links
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e5b77e694487d7e5a41912eccf647ccf094a78c7
Fixed
9d203a6950de7860e11b25e4265ed8fe60082d7d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.4.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "9d203a6950de7860e11b25e4265ed8fe60082d7d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58746.json"