Database/Control plane, storage & DevOps
Grafana: Unauthenticated directory traversal via /public/plugins/<id>/
CVSS 7.5CVE-2021-43798Control plane, storage & DevOpsKnown exploitedcurated
Impact
Unauthenticated directory traversal via /public/plugins/<id>/ -> read local files incl. grafana.db
Who can reach it
Network (remote)
What to do
Control-plane: upgrade; rotate every datasource credential stored in grafana.db
References
Related entries
- Grafana: Stored XSS via Unified AlertingCVE-2022-31097 · GrafanaHigh
- Grafana: A user can block another user's login by registering their email address as a usernameCVE-2022-39229 · GrafanaMedium
- Grafana: SQL Expressions passes user input to duckdb unsanitizedCVE-2024-9264 · GrafanaCritical
- Grafana: Unauthenticated access to snapshots via /api/snapshots/:keyCVE-2021-39226 · GrafanaCritical
- Grafana: Azure AD accounts validated on the mutable, non-unique email claimCVE-2023-3128 · GrafanaCritical
- Grafana: Client path traversal + open redirectCVE-2025-4123 · GrafanaHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.