CVE-2021-43798 - Grafana Labs Grafana

Overview

A source-backed snapshot of this vulnerability.

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: <grafana_host_url>/public/plugins//, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

CISA KEVyesWhether CISA lists this as exploited.

Techniques0AI attack methods connected to this vulnerability.

Case studies0Examples where this vulnerability is mentioned.

Vulnerability status

How serious this vulnerability is and whether it is known to be exploited.

CISA KEVHIGH

CVE ID: CVE-2021-43798
Vendor/project: Grafana Labs
Product: Grafana
Vulnerability name: Grafana Path Traversal Vulnerability
Date added: 2025-10-09
Due date: 2025-10-30
Known ransomware campaign use: Unknown
CVSS v3: 7.5

CWE-22

Exploit context

What the vulnerability is about.

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: <grafana_host_url>/public/plugins//, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Related AI techniques

AI attack methods connected to this vulnerability.

View all related techniques →

No related AI attack methods. No AI attack method is connected to this vulnerability in the current data.

Related case studies

Examples where this vulnerability is mentioned.

View all case studies →

No related case studies. No case study currently mentions this vulnerability.

Source evidence

Original public records and references for this page.

View all sources →

Original source

Original source links

Open the public records and source datasets used for this page.

NVD CVE pagehttps://nvd.nist.gov/vuln/detail/CVE-2021-43798 CVE API docshttps://nvd.nist.gov/developers/vulnerabilities Data feedshttps://nvd.nist.gov/vuln/data-feeds Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalog Data repositoryhttps://github.com/cisagov/kev-data af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2021/12/09/2 af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2021/12/10/4 af854a3a-2127-422b-91ae-364da2661108https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce af854a3a-2127-422b-91ae-364da2661108https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p af854a3a-2127-422b-91ae-364da2661108https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211229-0004/134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798