7.5

CVE-2021-43798

Warnung
Exploit

Grafana path traversal

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana Version >= 8.0.1 < 8.0.7
Grafana ≫ Grafana Version >= 8.1.0 < 8.1.8
Grafana ≫ Grafana Version >= 8.2.0 < 8.2.7
Grafana ≫ Grafana Version8.0.0 Updatebeta1
Grafana ≫ Grafana Version8.0.0 Updatebeta2
Grafana ≫ Grafana Version8.0.0 Updatebeta3
Grafana ≫ Grafana Version8.3.0

09.10.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Grafana Path Traversal Vulnerability

Schwachstelle

Grafana contains a path traversal vulnerability that could allow access to local files.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 88.85% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html
Third Party Advisory
Exploit
VDB Entry
http://www.openwall.com/lists/oss-security/2021/12/09/2
Patch
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2021/12/10/4
Patch
Third Party Advisory
Mailing List
https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce
Patch
Third Party Advisory
https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
Patch
Vendor Advisory
https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/
Vendor Advisory
https://security.netapp.com/advisory/ntap-20211229-0004/
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798
US Government Resource