CVE-2021-43798 — Grafana Path Traversal Vulnerability

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugin

01What is this vulnerability?

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to…

02Affected products

Vendor	Product	Versions
grafana	grafana	>= 8.0.0, < 8.0.7, >= 8.1.0, < 8.1.8, >= 8.2.0, < 8.2.7, = 8.3.0

03Active exploitation status

Yes — actively exploited. Added to the CISA KEV catalog on 2025-10-09. Ransomware use: Unknown.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2021-12-07T18:25:10.000Z
• Last modified: 2025-10-21T23:25:24.009Z
• Added to CISA KEV: 2025-10-09
• BOD 22-01 due: 2025-10-30

09References

• github.com — https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
• github.com — https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545…
• packetstormsecurity.com — http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
• grafana.com — https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-dir…
• packetstormsecurity.com — http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Ar…
• www.openwall.com — http://www.openwall.com/lists/oss-security/2021/12/09/2
• www.openwall.com — http://www.openwall.com/lists/oss-security/2021/12/10/4
• security.netapp.com — https://security.netapp.com/advisory/ntap-20211229-0004/