CVE-2021-43798
Grafana Labs Grafana: Path Traversal
As of , CVE-2021-43798 in Grafana Labs Grafana is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 9 October 2025
- US federal deadline
- 30 October 202521 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.89Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- 1 Metasploit module and 1 Exploit-DB entry
- Fix
- Vendor advice: grafana.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Grafana contains a path traversal vulnerability that could allow access to local files.
CISA's description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
The CVE record's description, from GitHub_M
- CVE published
- 7 December 2021
- Assigned by
- GitHub_M
- CVSS
- 7.5 High (CVSS 3.1, from the CNA)
- CWE-22
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- partial
Timeline
- The CVE record was published.
- Exploit-DB published an exploit (EDB-ID 50581).
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: Grafana Plugin Path Traversalauxiliary module, rank normal
- Exploit-DB: Grafana 8.3.0 - Directory Traversal and Arbitrary File ReadEDB-ID 50581, 9 December 2021
Grafana: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39226Authentication Bypass | Grafana Labs Grafana | Patch this weekEPSS 0.99 | 0.99 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org