Grafana Directory Traversal and Arbitrary File Read Vulnerability (CVE-2021-43798) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTOn-premise Grafana installations running versions 8.0.0-beta1 through 8.3.0 (excluding Grafana Cloud)
Unauthenticated remote attackers can exploit directory traversal to read sensitive local system and configuration files
Immediately upgrade to patched versions (8.0.7, 8.1.8, 8.2.7, or 8.3.1+) or block the vulnerable URL path via reverse proxy
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Grafana package to the latest stable version or patched releases (8.0.7, 8.1.8, 8.2.7, or 8.3.1+).
# Upgrade on Debian/Ubuntu systems
sudo apt-get update
sudo apt-get --only-upgrade install grafana
# Upgrade on RedHat/CentOS systems
sudo yum update grafana
# Upgrade Docker container (e.g., to version 8.3.1)
docker pull grafana/grafana:8.3.1
docker stop grafana-container
docker run -d --name grafana-container -p 3000:3000 grafana/grafana:8.3.12. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block external requests targeting the vulnerable /public/plugins/ path using a reverse proxy such as Nginx.
# Nginx reverse proxy mitigation configuration
server {
listen 80;
server_name grafana.example.com;
# Block directory traversal attempts on the plugin endpoint
location ~* /public/plugins/.*/.* {
return 403 'Access Denied: Security Mitigation Active';
}
location / {
proxy_pass http://localhost:3000;
proxy_set_header Host $host;
}
}3. Log Audit & IoC Verification Commands
Scan your Grafana or reverse proxy access logs for directory traversal patterns (..%2f or ../) targeting the plugin directory.
# Search for exploitation attempts in Grafana or Nginx logs
grep -Ei 'public/plugins.*/\.\./' /var/log/grafana/grafana.log
grep -Ei 'public/plugins.*%2f' /var/log/nginx/access.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-43798) is a directory traversal flaw in Grafana's plugin asset delivery router due to insufficient input validation [1, CWE-22]. Grafana utilizes the /public/plugins/<plugin-id> endpoint to serve static assets for installed plugins. Because the application failed to sanitize the plugin ID and subsequent path parameters, attackers can inject directory traversal sequences (e.g., ../) to escape the intended directory.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP request to a vulnerable Grafana instance [1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N]. By targeting default system plugins (such as alertlist, mysql, or postgres) and appending relative path traversal sequences like ../../../../../../../../etc/passwd, the attacker forces the server to traverse up to the root directory and read arbitrary files from the local file system.
3. Infrastructure & Business Impact
Given its inclusion in the CISA KEV catalog, this vulnerability has been actively exploited in the wild [isKev: true]. Successful exploitation allows attackers to read sensitive files, including /etc/passwd, Grafana's internal database (grafana.db), and configuration files (grafana.ini). This can lead to the exposure of database credentials, API keys, SMTP credentials, and OAuth secrets, resulting in full infrastructure compromise.
Official Vendor Advisories & References
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Frequently Asked SecOps Questions (CVE-2021-43798)
FAQQ1. How critical is CVE-2021-43798 and is it actively exploited in the wild?
CVE-2021-43798 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 88.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-43798?
Primary impacted vendors include grafana across grafana. Scope summary: Grafana versions 8.0.0-beta1 through 8.3.0 (Grafana Cloud is not affected)
Q3. What temporary mitigations or workarounds exist for CVE-2021-43798 before patching?
[Mitigation] Immediately upgrade to patched versions (8.0.7, 8.1.8, 8.2.7, or 8.3.1+) or block the vulnerable URL path via reverse proxy Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-43798
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (grafana)
View Category →Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
WebDyne Perl Framework Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-78189)
[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.