High severity · published Dec 7, 2021
CVE-2021-43798
Grafana path traversal
In wildKEV
7.5
CVSS
88.5%
EPSS
Yes
On KEV
Description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)88.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 9, 2025
Federal remediation dueOct 30, 2025
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
>= 8.0.0, < 8.0.7; >= 8.1.0, < 8.1.8; >= 8.2.0, < 8.2.7; = 8.3.0 · source: vendor, NVD, KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2021-43798: Grafana Labs Grafana - Grafana Path Traversal Vulnerability
Grafana contains a path traversal vulnerability that could allow access to local files.
GRGrafanaCVE-2021-43798
Oct 9, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43798
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
x_refsource_MISC
https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce
x_refsource_MISC
http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
x_refsource_CONFIRM
https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/
x_refsource_MISC
http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html
mailing-list
http://www.openwall.com/lists/oss-security/2021/12/09/2
More from Grafana
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.9
CVE-2025-11539
Arbitrary Code Execution in Grafana Image Renderer Plugin
9.8
CVE-2025-41115
Incorrect privilege assignment
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used